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Abstract. Shanks's infrastructure algorithm and Buchmann's algorithm for computing class groups and 
unit groups of rings of integers of algebraic number fields are most naturally viewed as computations inside 
Arakelov class groups. In this paper we discuss the basic properties of Arakelov class groups and of the 
set of reduced Arakelov divisors. As an application we describe Buchmann's algorithm in this context. 



1. Introduction. 

In his 1972 Boulder paper [26], Daniel Shanks observed that the quadratic forms in the 
principal cycle of reduced binary quadratic forms of positive discriminant exhibit a group- 
like behavior. This was a surprising phenomenon, because the principal cycle itself con- 
stitutes the trivial class of the class group. Shanks called this group-like structure 'inside' 
the neutral element of the class group the infrastructure. He exploited it by designing 
an efficient algorithm to compute regulators of real quadratic number fields. Eight years 
later, Hendrik Lenstra made Shanks's observations more precise. He introduced a certain 
topological group and provided a satisfactory framework for Shanks's algorithm [17, 25]. 
Both Shanks [27, sect.l] and [32, sect. 4. 4] and Lenstra [17, sect. 15] indicated that the in- 
frastructure ideas could be generalized to arbitrary number fields. This was done first by 
H. Williams and his students [33] for complex cubic fields, then by J. Buchmann [2, 3, 4] 
and by Buchmann and Williams [6]. Finally in 1988, Buchmann [ 7, 8] described an algo- 
rithm for computing the class group and regulator of an arbitrary number field that, under 
reasonable assumptions, has a subexponential running time. It has been implemented in 
the LiDIA, MAGMA and PARI software packages [21, 22, 24]. 

In these expository notes we present a natural setting for the infrastructure phe- 
nomenon and for Buchmann's algorithm. It is provided by Arakelov theory [28, 29, 31]. 
We show that Buchmann's algorithm for computing the class number and regulator of a 
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number field F has a natural description in terms of the Arakelov class group Picp of F 

and the set Rcdj? of reduced Arakelov divisors. We show that Lenstra's topological group 
is essentially equal to the Arakelov class group of a real quadratic field. We also introduce 

the oriented Arakelov class group Pic p. This is a natural generalization of Picp, useful for 
analyzing Buchmann's algorithm and for computing the units of the ring of integers Op 
themselves rather than just the regulator. 

The main results of the paper are to be found in sections 7 and 12. Here we discuss 
the basic properties of reduced Arakelov divisors and Buchmann's algorithm respectively. 

In section 2 we introduce the Arakelov class group of a number field F. In section 3 we 
study the etale R-algebra F ®q R. In section 4 we discuss the relations between Arakelov 
divisors, Hermitian line bundles and ideal lattices. In section 5 we define the oriented 
Arakelov class group and in section 6 we give both Arakelov class groups a natural trans- 
lation invariant Riemannian structure. The rest of the notes is devoted to computational 
issues. Section 7 contains the main results. Here we introduce reduced Arakelov divisors 
and prove their basic properties. In section 8, we work out the details for quadratic number 
fields. In section 9 we present explicit examples illustrating various properties of reduced 
divisors. In section 10 we discuss the computational aspects of reduced Arakelov divisors. 
In section 11 we present a deterministic algorithm to compute the Arakelov class group. 
Finally, in section 12 we present Buchmann's algorithm from the point of view of Arakelov 
theory. See [23] for the basic properties of algebraic number fields. 

I thank the Clay Foundation for financial support during my stay at MSRI in the fall 
of 2000, Hendrik Lenstra and Sean Hallgren for several useful remarks and Young Ju Choie 
for inviting me to lecture on 'infrastructure' at KIAS in June 2001. 

2. The Arakelov class group. 

In this section we introduce the Arakelov class group of a number field F. This group is 
analogous to the degree zero subgroup of the Picard group of a complete algebraic curve. 
In order to have a good analogy with the geometric situation, we formally 'complete' the 
spectrum of the ring of integers Oi? by adjoining primes at infinity. An infinite prime of F 
is a field homomorphism a : F — > C, considered up to complex conjugation. An infinite 
prime a is called real when a{F) C R and comp/ex otherwise. We let ri and r2 denote the 
number of real and complex infinite primes, respectively. We have that ri + 2r2 = n where 
n=[F:Q]. 

An Arakelov divisor is a formal finite sum D = Upp + x^^a, where p runs over 
the non-zero prime ideals of Op and a runs over the infinite primes of F. The coefficients 
Up are in Z but the can be any number in R. The Arakelov divisors form an additive 
group, the Arakelov divisor group Divi;'. It is isomorphic to ©p Z x Q)a R- The principal 
Arakelov divisor associated to an element / e F* is the divisor (/) = J2p '^pP + Yla ^o-*^ 
with Up = ordp(/) and x^rif) = — log|cr(/)|. The principal Arakelov divisors form a 
subgroup of DivF- 

Since it is analogous to the Picard group of an algebraic curve, the quotient of Div^? 
by its subgroup of principal Arakelov divisors is denoted by Picp- A principal Arakelov 
divisor (/) is trivial if and only if / is a unit of Of all of whose conjugates have absolute 
value equal to 1. It follows that (/) is trivial if and only if / is contained in the group of 
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roots of unity fxp- Therefore there is an exact sequence 



Div, 



PiCF 



0. 



We call / = Yip P "^'' the ideal associated to an Arakelov divisor D = npp + '^^x^o'. 
The ideal associated to the zero Arakelov divisor is the ring of integers Op- The ideal 
associated to a principal Arakelov divisor (/) is the principal ideal f~^OF- Here and in 
the rest of the paper we often call fractional ideals simply 'ideals'. If we want to emphasize 
that an ideal is integral, we call it an Oi?-ideal. 

The map that sends a divisor D to its associated ideal / is a homomorphism from 
DivF to the group of fractional ideals Idp of F. Its kernel is the group ®o- R of divisors 
supported in the infinite primes. We have the following commutative diagram, the rows 
and columns of which are exact. 















Pid, 



iR 



Divi? 



Id, 



PiCF 



CI J 





Here Pidi? denotes the group of principal ideals of F. The map F* / fip — ^ Divp induces a 
homomorphism from 0*p/ fiF to ®a R- This homomorphism is given by £ i— > (— log|cr(£) |)cr 
and its cokernel is denoted by T. 

The norm N{p) of a non-zero prime ideal p of Of is the order of its residue field Of/P- 
The degree deg(p) of p is defined as log(A^(p)). The degree of an infinite prime a is equal 
to 1 or 2 depending on whether a is real or complex. The degree extends by linearity to 
a surjective homomorphism deg : Divi? — > R. The norm N(D) of a divisor D is defined 
as N{D) = e'^^^^^\ The divisors of degree form a subgroup Div^ of Divj?. By the 
product formula, Div^ contains the principal Arakelov divisors. 

Definition 2.1. Let F be a number field. The Arakelov class group Pic% of F is the 
quotient of Div^ by its subgroup of principal divisors. 

The degree map deg : Div^? — R factors through Picp and the Arakelov class 
group is the kernel of the induced homomorphism deg : Pic^ — > R. We let (©crR)'^ 
denote the subgroup of divisors in (Ba R that have degree zero and the cokernel of the 
homomorphism Op — > (©crR)°- In other words, is the quotient of the vector space 
{Ma e ©aR : J2a^^si^)'"cr = 0} by the group of vectors {(log|cr(£)|)^ : e E 0*p}. By 
Dirichlet's unit theorem it is a compact real torus. 
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Proposition 2.2. There is a natural exact sequence 

— > T° — > Pi4 — > CIf — > 0. 

Proof. Since F has at least one infinite prime, the composite map Div^ DivF — ^ Wf 
is stiU surjective. The result now follows by replacing the groups Divi?, PIcf, T and ffio-R 
in the diagram above by their degree subgroups. 

The group T° is the connected component of the identity of the topological group Pic^?'. 
It follows that Pic^, being an extension of the finite class group by T^, is a compact real 
Lie group of dimension ri + r2 — 1. 

Definition 2.3. The natural homomorphism Div^ — > Id_p admits a section 

d : Idi? — > Div^. 

It is given by d{I) — D where D — Upp + XcrCr is the Arakelov divisor for which we 
have I = Hp P""'" and Xg- = — ^log(A^(/)) for every infinite prime cr. 

Proposition 2.4. Let d : Idp — ^ Pic^^ denote the homomorphism that maps I to the 
class of the divisor d{I) . Then the sequence 

— > {f e F* : all \a{f)\ are equal} //IF — > Idp Pic% 

is exact. Moreover, the image of d is dense in Pic^ . 

This proposition is not used in the rest of the paper. We do not prove it, because it 
follows immediately from Proposition 6.4 below. The kernel of d is not a very convenient 
group to work with. This is one of the reasons for introducing the oriented Arakelov 
divisors in section 5. 

Finally we remark that there is a natural surjective homomorphism A*p — > Divp 
from the idele group to the Arakelov divisor group. It follows that Picp is a quotient 
of the idele class group. We do not make any use of this fact in the rest of the paper. 

3. Etale R-algebras. 

Let F be a number field of degree n. In this section we study the R-algebra Fr, = F(8)q R. 

For any infinite prime a of F, we write F^ for R or C depending on whether a is 
real or complex. The natural map F — > Ho- -^^r that sends / G F to the vector {a{f))a, 
induces an isomorphism Fr = F (8)q R = Yla R-algebras. Let u ^ u denote the 

canonical conjugation of the etale algebra Fr. In terms of the isomorphism Fr ^ Yla ^cn 
it is simply the morphism that maps a vector u = (tto-)o- to It = {ua)a- In these terms it is 
also easy to describe the set of invariants of the canonical conjugation. It is the subalgebra 

For any u G Fr, we define the norm N{u) and trace Tr('u) of u as the determinant 
and trace respectively of the n x n-matrix (with respect to any R-basis) of the R-linear 
map Fr — > Fr given by multiplication by u. In terms of coordinates, we have for 
« = Ma e Fg that Tt{u) = deg((7)Re(«,) while N{u) = Ua 
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Being an etale R-algebra, Fr, admits a canonical Euclidean structure [13]. It is given 
by the scalar product 

(w, v) = Tr{uv), for u,v & Fr,. 

This scalar product has the 'Hermitian' property {Xu,v) — {u, Xv) for u,v,X G Fr,. In 
terms of coordinates, we have for u = (tto-)cT ^ind v = {va-)a in -^r — YYa ^^at 

u 

We write \u\ — {u^u)^^"^ for the length oi u E Fr. For the element 1 G F C Fr we 
have that ||1|| = ^/n. For every u G Fr, all coordinates of the product uu G Ha -^o- are 
non-negative real numbers. We define \u\ to be the vector 

\u\ = {\Ua\)a 

in the group Yla ^+ -^r- Here we let H*^ = {x E R* : x > 0}. We have |wp = uu. The 
map u 1-^ \u\ is a homomorphism. It is a section of the inclusion map Yl^ R!^ C F^. 

Proposition 3.1. Let F be a number Geld of degree n. For every u G Fr we have that 
(i) 

N{uuY^'^ < ^Tr(uIt); 
\N{u)\ <n-"/2||w|r. 

In either case, equahty holds if and only if u is contained in the subalgebra R of Fr. 

Proof. Since all coordinates of uu are non-negative, part (i) is just the arithmetic- 
geometric mean inequality. The second inequality follows from (i) and the fact that 

N{u) = N{u). 

This proves the proposition. 

4. Hermitian line bundles and ideal lattices. 

In this section we introduce the Hermitian line bundles and ideal lattices associated to 
Arakelov divisors and study some of their properties. 

Let F be a number field of degree n and let D = J2p ^pP + J2cr ^^r^ t)e an Arakelov 
divisor. By / = Y[p P~"''' we denote the ideal associated to D in section 2 and by u the 
unit (exp(— Xcr))a ^ Ho- *^ -^R- '^^^^ leads to the following definition. 

Definition 4.1. Let F be a number field. A Hermitian line bundle is a pair (/, u) where 
/ is a fractional F-ideal and u a unit of the algebra Fr = Yla whose coordinates 

are positive real numbers. 

As we explained above, to every Arakelov divisor D there corresponds a Hermitian line 
bundle {I,u). This correspondence is bijective and we will often identify the two notions. 
The zero Arakelov divisor corresponds to the trivial bundle {Of A)- A principal Arakelov 
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divisor (/) corresponds to the Hermitian line bundle {f~^OF, |/|) and the divisor d{I) asso- 
ciated to a fractional ideal / at the end of section 2, corresponds to the pair (/, A^(/)~^/"). 
Note that A^(/)~^/" is contained in the 'diagonal' subgroup of Yi^ It follows from 
the formulas for N[u) given in the previous section that the degree of an Arakelov divisor 
D = {I,u) is equal to -log(|A^('u) |A^(/)). 

Definition 4.2. Let F be a number field. An ideal lattice of F is a projective rank 1 
Oi?-module L equipped with a real valued positive definite scalar product on L ®z R 
satisfying {Xx,y) = {x,\y) for x,y E L (8)z R and A e Fr,. Two ideal lattices L, L' are 
called isometric if there is an O^-isomorphism L = L' that is compatible with the scalar 
products on L <Siz R and L' <Siz R- 

Here A i— > A is the canonical algebra involution of the etale R-algebra Fr, introduced in 
section 3. Note that it need not preserve F. Note also that L ®z R has the structure of 
an FR-module. See [1, 13] for more on ideal lattices. There is a natural way to associate 
an ideal lattice to an Arakelov divisor D. It is most naturally expressed in terms of 
the Hermitian line bundle associated to D. The Oi?-module / is projective and of 

rank 1. Multiplication by u gives an Oi?-isomorphism with ul = {ux : x E 1} C Fr. The 
canonical scalar product on Fr introduced in section 3 gives ul the structure of an ideal 
lattice. Alternatively, putting 

1/1,, = Ki, for/e/, 

we obtain a scalar product on / itself that we extend by linearity to / R- In ad- 
ditive notation, if / e / and u e F^ is equal to exp((— Xcr)^), then uf is equal to the 
vector {o-{f)e~'^'^)cr £ Fr and we have that ||/|||, = [jw/P = 5^^^ deg((T)|cr(/)e~^''P for 

The ideal lattice corresponding to the zero Arakelov divisor, i.e. to the trivial bundle 
(Oi?, 1), is the the ring of integers Of viewed as a subset of F C Fr equipped with its 
canonical Euclidean structure. The covolume of this lattice is equal to i^/|A^, where A p 
denotes the discriminant of the number field F. The covolume of the lattice associated to 
an arbitrary divisor D = (I, u) is equal to 

covol(F>) = y/\A^\N{I)\N{u)\ = y/\A^\/N{D) = ^ATfe-^^^^^^). 

For any ideal /, the lattice associated to the Arakelov divisor d{I) = (/, A^(/)~^/"') can be 
thought of as the lattice / C F C Fr equipped with the canonical scalar product of Fr, 
but scaled with a factor N{I)~^/'^ so that its covolume is equal to y^jA^. 

Proposition 4.3. Let F be a number field of discriminant Ap- 
(i) Tlie map that associates the ideal lattice ul to an Arakelov divisor D — (/, u), induces 

a bijection between the group Ficp and the set of isometry classes of ideal lattices, 
(a) The same map induces a bijection between the group Pic% and the set of isometry 

classes of ideal lattices of covolume ^/\Af\- 
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Proof. Let D = (/, u) be an Arakelov divisor and let D' = D + {g) for some g E F*. Then 
we have D' = {g~^I,u\g\) and multiphcation by g induces and isomorphism g~^I = / of 
Oi?-modules. This map is also an isometry between the associated lattices since 

Wg-'flD' = \\u\g\g-'f\\ = \\uf\\ = If Id, for all / e / ®z R- 

Here we use the fact that v = \g\g~^ satisfies vv — 1 and that therefore \vh\ = Tr{vhvh) = 
Tr(/i/i) = \\h\\ for all h G /(8>z R- We conclude that the map that sends an Arakelov divisor 
to its associated ideal lattice induces a well defined map from Ficp to the set of isometry 
classes of ideal lattices. This map is injective. Indeed, if D = (/, u) and D' = (/', u') give 
rise to isometric lattices, then there exists g E F* so that /' = gl and US'/Id' = 
for all / G / ®z R- This means that ||w'(7/|| = \\uf\\ for all / G / ®z R = -^R- For any 
infinite prime a, we let G -Fr be the idempotent for which a{ea) = 1 while a'{ea) = 
for all a' ^ a . Substituting / = Co-, we find that \o{^g)u'^\ — \ua\ for every a. It follows 
that l^rj = ulu\ implying that D' = D + (g) as required. 

To sec that the map is surjective, consider an ideal lattice L with Hermitian scalar 
product (( — ,—)) on L ®z R = F^. We may assume that L is actually an Oi?-ideal. 
The idempotent elements e^r in F^ = Yia are invariant under the canonical involu- 
tion. This implies that the are pairwise orthogonal because {{e^^Ca')) — ((e^,ecr')) = 
((co-, eo-Co-')) = 0. Therefore the real numbers u^r = {{^(n^a))^^'^ determine the metric 
on / (8)z R- The Arakelov divisor {L,u) with u = (tto-)(T £ Yla then mapped to the 

isometry class of L. 

This proves (i). Part (ii) follows immediately from this. 

The following proposition is concerned with the lengths of the shortest non-zero vectors 
in the lattices associated to Arakelov divisors. 

Proposition 4.4. Let F be a number field of degree n and let D = (/, u) be an Arakelov 
divisor. Then 

(i) for every non-zero / in / we have that 

Moreover, equality holds if and only if we have D = {fOp, X\f\~^) for some A > 0. In 
other words, if and only if D is equal to the principal Arakelov divisor — (/), scaled 
by a factor A > 0; 

(ii) there exists a non-zero / G / such that \uaCr{f)\ < (|:)'^^^"^ covol(Z))^/"^ for every a 
and hence 

\\f\\n<V^-{^y'^''coyo\iDy/\ 

Here r2 is the number of complex primes of F. 
Proof, (i) Let / G /. By Prop. 3.1 we have that \\f\\l = \\uff > n|iV(u/)|2/". Since 
|A^(/)| > N{I) we find that 

WfWl > n|Ar(«)iV(/)p/" = ne-^^^sW. 
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The last inequality follows from the fact that deg{D) — — log \N{u)N{I)\. This proves the 
first statement. By Prop. 1.3 equality holds if and only if all |W(jCr(/)| are equal to some 
A > and if / is the principal ideal generated by /. This implies that D is of the form 
{f^^Op, as required. 

To prove (ii) consider the set V — {{ya)a e Fr : \y^\ < (D'^/'covoKl))!/- for aU a}. 
This is a bounded symmetric convex set of volume 2^i(27r)^2 inY^ covol(£)) = 2"'covol(D). 
By Minkowski's Convex Body Theorem there exists a non-zero element f & I for which 
{ucrcr{f))a- e til C Fr, is iu V. This implies (ii). 

This proves the proposition. 

We mention the following special case of the proposition. 

Corollary 4.5. Let D = (/, u) be an Arakelov divisor of degree 0. Then any non-zero 
f E I has the property that ||/||d > y/n, with equahty if and only if D = —{f). On the 

other hand, there exists a non-zero f E I with < -\/n {^Y^^^ y/l^pl^^^- 

Part (i) of Prop. 4.4 says that the lattices associated to Arakelov divisors D are rather 
'nice'. They are not very skew in the sense that they do not contain any non-zero vectors 
that are extremely short with respect to covol(-D)^/"^. This property can be expressed by 
means of the Hermite constant 7(-D). The latter is defined as the square of the length of 
the shortest non-zero vector in the lattice associated to D divided by covol(Z))^/"^. The 
skewer the lattice, the smaller is its Hermite constant. The constant 7(D) only depends 
on the class of D in Picj?. 

Corollary 4.6. Let F he a number field of degree n and let D = (/, u) be an Arakelov 
divisor. Then 

7- — ;T-r- < 7 -D) < n - 
|Af|1/" - /V / - \t,j 

The lower bound is attained if and only if D is a principal divisor scaled by some X > as 
in Prop. 4.4 (i). 

The function h^{D) = log ^J^j^j exp(— 7r||/|||,)^ introduced in [31] and briefly dis- 
cussed in section 10, is related to the Hermite constant 7(-D). Indeed, for most Arakelov 
divisors D = (/, u) the shortest non-zero vectors in the associated lattice are equal to 
products of a root of unity by one fixed shortest vector. Moreover, for most D the con- 
tributions of the zero vector and these vectors constitute the bulk of the infinite sum 
5^jgjexp(— 7r||/|||,). Therefore, for most Arakelov divisors D the quantity {h^{D) — 1)/wf 

is close to exp(— 7r7(D)covol(D)^/"'). Here wp denotes the number of roots of unity in the 
field F. 
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5. The oriented Arakelov class group. 

In this section we introduce the oriented Arakelov divisor group Picp associated to a 
number field F. 

In section 4 we have associated to an Arakelov divisor D a Hermitain line bundle (/, u) . 
Here / is an ideal and u is a unit in _|_ = Yl^ IV^. An oriented Hermitian line bundle is a 
pair (/, u) where / is an ideal and u is an arbitrary unit in F^ = F* . The corresponding 
oriented Arakelov divisors are formal sums Upp + X^j^a^o-c with np e Z and £ F*. 

They form a group DIvf and we have that 

DivF = idF X F^^ez X TTf;. 

a 

The principal oriented Arakelov divisor associated to / G F* is simply the oriented divisor 
corresponding to the oriented Hermitian bundle (/~^Oi?, /), where the second coordinate 
/ is viewed as an element of F^. The cokernel of the injective homomorphism F* — > DiYp 
is denoted by Pici?. The inclusion Divp C Divp admits the natural section Divi? — > Div^ 
given by (/, w) ^ (/, \u\). The degree deg(-D) of an oriented Arakelov divisor D — {I,u) 
is by definition the degree of the 'ordinary' Arakelov divisor (/, \u\). In this way principal 
oriented Arakelov divisors have degree 0. 

- — 

Definition 5.1. The quotient of the group Div^ of oriented Arakelov divisors of degree 

by the subgroup of principal divisors is called the oriented Arakelov class group. It is 

— 

denoted by Pic^. 

The commutative diagram below has exact rows and columns. The bottom row relates 
the groups Ficp and Pic^ to one another. 



IJ,F 



F*/i^F 



Div, 



Div 



iUaKa)/fiF PiCp Pi4 



Here denotes the maximal compact subgroup of F*. In other words K^^ = {1,-1} if 
a is real, while = {2; e C* : |2;| = 1} if u is complex. Since Pic^ and the groups Kcr 
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are compact, it follows from the exactness of the bottom row of the diagram that Pic^ is 
compact as well. 

~o 

In order to see the topological structure of Pic^ better, we construct a second exact 
sequence. Let ^^^^ denote the connected component of 1 G F^. It is isomorphic to 
a product of copies of R^j. for the real primes and F* = C* for the complex ones. It is 

precisely the kernel of the homomorphism Divp — ^ Wf x Her reaii^-'-}' given by mapping 
D = {I,u) to (/, sign(ii)). Here sign(ti) denotes the vector (sign('Uo-))(j real- 
Definition 5.2. By T we denote the quotient of the group F^ ^^^^ by its subgroup Op _|_ = 
{e G Op : a{e) > for all real a}. Taking degree zero subgroups, we put (F^ conn)^ — 
e F^,,,,, : N{u) = 1} and = (i^^,conn)70^,+- 

The map T — > Ficp given hj v {Of,v) is a, well defined homomorphism. So is 
the map Pic^ — > CIf,+ that sends the class of the divisor (/, u) to the narrow ideal class 
of gl where g & F* is any element for which sign(5f) = sign(w). Here the narrow ideal 
class group CIf,+ is defined as the group of ideals modulo the principal ideals that are 
generated by / G = {/ G F* : a{f) > for aU real a}. It is a finite group. 

The following proposition says that the groups T and T° are the connected components 
of identity of PIcf and Pic^ respectively. It provides an analogue to Proposition 2.2. 

Proposition 5.3. Let F he a number Geld of degree n. 
(i) The natural sequences 

— > f — > pTcf — > CIf,+ — > 

and 

— ^ T° — > Picp — > CIf,+ — > 

are exact. ^ 
(a) The groups T and T° are tie connected components of identity of Pic^ and Ficp 
respectively. The group T has dimension n while T^ is a compact torus of dimen- 
sion n — 1. 

Proof, (i) Let Pid^ denote the image of the map F* — > Div^ — > Id^ x Yl^ real )• 
This leads to the following commutative diagram with exact rows. 

— > OJ,+ — > F* — > Pidp — > 

— i^^,co„„ ^ DiVp IdF X n. real{±l} ^ 0. 

The vertical maps in this diagram are all injective. An application of the snake lemma 
shows that the sequence of cokernels is exact. This is the first exact sequence of (i). 
Indeed, the kernel of the surjective homomorphism Idp x reaii^'^-'^} — ^ ^^f,+ given by 
mapping a pair (I, s) to the narrow ideal class of gl where ^ G F* is any element for which 
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sign(^) = s, is precisely equal to Pidi?. The second exact sequence is obtained by taking 
degree zero parts. 

(u) Since CIf,+ is finite and both groups T and T° are connected, the first statement is 
clear. Since the Lie group ^^^^^^ has dimension n, so do the groups T and Pic^. It 

follows that the groups and Pic^ have dimension n — 1. 
This proves the proposition. 

Note that the classes of two extended Arakelov divisors (/, u) and (J, v) are on the 

same connected component of Pic^^ if and only ii J = gl for some g & F* for which 
UuVugicr) > for each real a. 

Definition 5.4. An embedded ideal lattice is an ideal lattice L together with an Oi?-linear 
isometric embedding L ^ Fr,. 

To every oriented Arakelov divisor D = (/, u) we associate the ideal lattice ul together 
with the embedding ul C Fr,. Two embedded ideal lattices are called isometric if there is 
an isometry of ideal lattices that commutes with the embeddings. We have the following 
analogue of Proposition 4.3. 

Proposition 5.5. Let F be a number Geld of discriminant Ap. Then 
(i) the map that associates to an oriented Arakelov divisor D = (/, u) its associated 
embedded ideal lattice, induces a bijection between the oriented Arakelov class group 

Picp and the set of isometry classes of embedded ideal lattices; 

— - 

(a) the same map induces a bijection between Picp and the set of isometry classes of 
embedded ideal lattices of covolume ^/\K^. 

Proof. If two oriented Arakelov divisors D = (/, u) and D' = (/', u') differ by a principal 
divisor {f^^Opif)-, then multiplication by / induces an isometry between the embedded 
lattices ul and u'l' . Therefore the map in (i) is well defined. If the embedded lattices 
ul and u' I' are isometric, then this isometry is given by multiplication by some x G F^. 
Then / = u~^xu' is contained in F* and we have that D - D' = {f-^Op, /)• This shows 
that the map is injective. To see that the map is surjective, let / be a fractional ideal and 
let t : / > Fr, be an Op-lmeajc embedding. Tensoring / with R, we obtain an FR-linear 
isomorphism Fr, = / (8)z R- — -Pr which is necessarily multiplication by some u e F^. 
Therefore = ul and the oriented divisor (/,tt) maps to the embedded ideal lattice 
i-.I^F^. 

This proves the proposition 

We will not use this in the rest of the paper, but note that there is a natural surjective 
homomorphism from the idele group A*p to the oriented Arakelov divisor group Divi?- It 
follows that the group Picp is a quotient of the idele class group. 



11 



6. Metrics on Arakelov class groups. 

Let F be a number field. In this section we provide the Arakelov class groups PiCi? and 
PiCi^ with translation invariant Riemannian structures. 

By the diagram in section 2, the connected component T of the group Picp is isomor- 
phic to R modulo the closed discrete subgroup A = {(log |a"(£)|)o- : £ G Op}. Therefore 
the tangent space at is isomorphic to ®o- R,- Identifying this vector space with the sub- 
algebra IlcrR °f -^R- ~ n<T^cr' inherits the canonical scalar product from Fr,. Since 
this R-valued scalar product is positive definite, both groups T and PIcf are in this way 
equipped with a translation invariant Riemannian structure. 

For u e Yl^IV^ G we let log(u) denote the element (log (ex (u)))^- G Ha ^ -^R- 
We have that 

\\\og{u)f = J2deg{<T)\log{a{u))\\ 

a 

Definition 6.1. For tt e T we put 



II till Pic = min ||log(w')||, 

=u (mod A) 



min II log(|£|w) 



Every divisor class in T is represented by a divisor of the form D = {Of,u) for some 
u e ©0-1^+ • Here u is unique up to multiplication by units e e Op. For such a divisor 
class in T we define 

||-D||pic = i'J^ipic- 

The function ||w||pig on T satisfies the triangle inequality. It gives rise to a distance function 
that induces the natural topology of PIcf- The distance is only defined for divisor classes 
D and D' that lie on the same connected component. By Prop. 2.2, the class of the 
difference D — D' is then equal to {Of,u) for some unique u E T and we define the 
distance \\D — -D'fpic between D and D' as ||w||pic. The closed subgroups T° and Pic^ 
inherit their Riemannian structures from PiCi?. 

The Euclidean structures of the ideal lattices corresponding to Arakelov divisors and 
the metric on Picp are not unrelated. The following proposition says that the difference 
between the Euclidean structures of two Arakelov divisors D,D' is bounded in terms 

of p-I^'||pic. 

Proposition 6.2. Let F be a number field and let D = (/, u) and D' = (/, u') be two 
Arakelov divisors. Then there exists a unit e e 0*p for which the divisor D" — {I,u'\e\) 
satisGes 

^-\\D-D"\\^,, < NL^ < el|o-o"l|pic^ for every a; el. 

\\x\\d" 

Note that the classes of D' and D" in Vicp are the same, so that we have \\D — -D'fpic = 

|p-i^"||pic. 
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Proof. Let e G 0*p be such that the expression deg(cr)log|cr(£)tt^/tto-p is minimal. 
Let D" = (/, \e\u'). Putting v = u'\e\/u vje have as a consequence 

\\D-D"\l,^ = Y,^eg{a)\og\v^\\ 

a 

For any x & I we have 

— ll'^'^^ll^ — \\vux\\'^ = deg (cr) I tto-i>o- (7 (x) I ^ < 



< max deg((7)|tto-(7(a;)|^ = ^max;|t;o-|^ Ikllo- 

cr 

Since we have 

log (max I^ctI ) = max log \vcr\ < max |log < \\D — D"||pic, 

\ cr / cr a 

the first inequality follows. The second one follows by symmetry. 

We now define a similar metric on the oriented Arakelov class group. By Prop. 5.3, 
the connected component of Vvcp is T = conn/^F+- recall that ^^^^ is the 
connected component of identity of the group F^. It is isomorphic to a product of copies 
of R^, one for each real prime, and C* one for each complex prime. The group 0*p is 
the subgroup of e G 0*p for which aie) > for every real infinite prime a. 

The exponential homomorphism exp : — > is defined in terms of the usual 
exponential function by exp(u) = (exp(uo.))cr for u = (u^) G Fr, = Ilcr-^cr- "^^^ image 
of the exponential function is precisely the group F^ The counterimage of Op_^_ 

is a discrete closed subgroup A of Fr. We have a natural isomorphism of Lie groups 
exp : Fa/A F^ pgmj/OJ. = T. Therefore the tangent space of T at is isomorphic 

to Fr,. The canonical scalar product on Fr provides both groups T and Pic with a 
translation invariant Riemannian structure. 

Definition 6.3. For u E T we put 

\\u\\~ = min \\y\\ 

" "Pic yeF^ 

exp(j/)=u (mod O* ) 

Explicitly, for u G F^ = Ho- -^ir ^og{u) denote the element (log(a"(u))o- G Ha -^c^ 

Fr. Here we use the principal branch of the complex logarithm. We have that 

ll^te " lUogMII = min ^deg((j)|log((j(£'u))p. 

Every divisor class in T can be represented by a divisor of the form D = {Of-,u) for 
some u G F^ conn- Here u is unique up to multiplication by units e G O^^.. For any 
divisor D of the form {Of-,u) with u G T we define 
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The function \\u\\ — on T satisfies the triangle inequahty and this gives rise to a distance 

Pic 

function that induces the natural topology on Picp- The distance is only defined for divisor 

classes D and D' that lie on the same connected component. By Prop. 5.3, the class of 

the difference D — D' is then equal to (Of^u) for some unique u & T and we define the 

distance \\D — D'\\:^ between D and D' as ||w|| — . 
II iipic II iipij, 

~n ^0 . . . 

The closed subgroups T and Pic^ inherit their Riemannian structures from PIcf- 

We leave to the task of proving an 'oriented' version of Proposition 6.2 the reader. 

The morphism d : Idp — Div^ given by d{I) ~ {I, N{I)~^/^) is a section of the 

- — 

natural map Div^ — > Idp. The embedded ideal lattice associated to d{I) is the ideal 
lattice / C Fr scaled by a factor N{I)~^/"'. This lattice has covolume y^[Ap[. 

Next we prove an oriented version of Proposition 2.4. It says that the classes of the 

~ 

divisors of the form d{I) are dense in Pic^ and it implies Proposition 2.4. The exactness 
of the first sequence of [17, section 9] is a special case. 

_ ~o 

Proposition 6.4. Let F be a number Geld of degree n. Let d ildp — > Picp be the map 

. — , 

that sends I to the class of the oriented Arakelov divisor d{I) in Vic p. Then the sequence 

— > Idq — > Idp Picp 
is exact. The image of the map d is dense in Pic p. 

Proof. Every ideal in Idq is generated by some / G Q>o- Let / G Q>o- Then d maps 

the F-ideal fOp to the class of the oriented Arakelov divisor {fOp, |A^(/) 1"^/"^). Since 

~ 

we have |A^(/)| = |/|"^, this divisor is equal to {fOpif )• Therefore its image in Pic^ 
is trivial. Conversely, suppose that a fractional ideal / has the property that the class 

of {I,N{I)~^/'^) is trivial in Pic^. That means that / = fOp for some f ^ F* and 

that / = Niiy/"". In other words, a{f) = A^(/)i/^ for aU infinite primes a. This implies 

that all conjugates of / are equal, so that / G Q*. This shows that the sequence is exact. 

_ - — 
To show that the image of d is dense, we let < e < 1 and pick D = (/, u) G Div^. 

Note that we have A'"(/)|A'"(tt)| = 1. Consider the set 

B = {(^o-)a e Fr : \v^ - < e\u^\ for aU a}. 

Then S is a an open subset of F^ and all f G S have the same signature as u. Since F is 
dense in Fr, there is an element / G B n F. 

The difference between d{fl) and the divisor D is equal to {fOp, N{fl)~^^'^u~^) 
which is equivalent to the Arakelov divisor {Op,v) where v = N{f /u)~^^'^u~^ f G F^. 

Therefore the distance between D and d(f~^I) is at most Ivll — . Since — 1| < e. 

Pic " 

it follows from the Taylor series expansion of the principal branch of the logarithm that 
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|log(^^)| < for all a and hence ^|fog(^|^)| < jz^- It follows that we have 
l^ll- < v^max|log(Ar(//«)-Vn«-V(/))|, 

JT IC (T 

- 1-e" 

This implies that the image of d is dense, as required. 

Finally we compute the volumes of the compact Riemannian manifolds Pic^ and Pic^. 

Proposition 6.5. Let F be a number Geld of degree n and discriminant Ap. Then 
(i) 

vol(Pic^) = "'^^ ■ |Af |i/2 . ResCf (s). 

(ii) 

vol(Pic^) = \/n- lA^I"*^^^ •ResC^(s). 

8 = 1 

Here ri is the number of real primes and r2 is the number of complex primes of F. By 
Wi? we denote the number of roots of unity and by C,f{,s) the Dedekind zeta function 
ofF. 

Proof, (i) 

The subspace (©o-R)'^ of divisors of degree is the orthogonal complement of 1 in the 
subalgebra Yl^ R of Fr. Using the fact that ||1|| = y^, one checks that the volume of Pic^ 
is equal to ^/n2~'^^/'^RF where Rp is the regulator of F. It follows from the exact sequence 
of Prop. 2.2 that the compact group Pic^ has volume ^/n2~'^'^^'^hFRF where hp — H^CIf 
is the class number of F. The formula [23] for the residue of the zeta function in s = 1 
now easily implies (i). 

(a) Since the natural volume of the group K^^ is 2 or 2-k\/2 depending on whether a is 
real or complex, it follows from the commutative diagram following Definition 5.1 that the 

volume of vol(Pic^) is equal to T'^{2'n\fiY'^ jwF times Pic^. This implies {ii). 
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7. Reduced Arakelov divisors. 

Let F be a number field of degree n. In this section we introduce reduced Arakelov divisors 
associated to F. These form a finite subset of Div^. The main result of this section is that 

n ~o 

the image of this set in the groups Pic^ and Pic^. is in a certain sense regularly distributed. 

The results of this section extend work by Lenstra [17] and Buchmann and Williams [5] 
and make certain statements by Buchmann in [3, 7, 8] more precise. In particular, Theo- 
rems 7.4 and 7.6 and Corollary 7.9 extend [3, section 2], [5, Prop. 2. 7] and [7, section 3.3]. 
Note that in deducing the corollaries below we did not make any particular effort to obtain 
the best possible estimates. They can most certainly be improved upon. 

Let / be a fractional ideal. A non-zero element / G / is called minimal if the only 
element g E I for which one has < for all infinite primes a, is g — 0. If / G / 

is minimal, then for every h & F*, the element hf is minimal in the ideal hi. In particular, 
a h & Op, the element hf is minimal in the same ideal /. Therefore there are, in general, 
infinitely many minimal elements in /. 

If D — (/, u) is an Arakelov divisor, then the minimal elements f E I are precisely the 
ones for which the open boxes {{ya)(T ^ -^R '■ IVal < |'*^crc(/)| for all a} contain only the 
point of the lattice ul. Note however that the notion of minimality depends only on / 
and is independent of the metric induced by the element u. Shortest elements f E I are the 
elements for which ||/||_d = niiii{||(7||_D '■ g & I — {0}}. This notion depends on the divisor 
D — (/, u) and hence on the lattice ul . It does not merely depend on /. Since \g\D = 1^5' || 
for each g E I, the vectors uf are the shortest non-zero vectors of the lattice ul associated 
to D. The number of shortest elements in / is always finite. Shortest vectors are clearly 
minimal, but the converse is not true. It may even happen that a minimal element f E I 
is not a shortest element of the lattice D = (/, u) for any choice of u. See section 9 for an 
explicit example. 

Definition. An Arakelov divisor or oriented Arakelov divisor D in Divi? is called reduced 
if it is of the form D = d{I) = (/, A^(/)~^/"^) for some fractional ideal /, and if 1 is a 
minimal element of /. The set of reduced Arakelov divisors is denoted by Redj?. 

Since reduced Arakelov divisors have degree zero, the covolume of the lattices associ- 
ated to reduced Arakelov divisors are equal to ^/\A^. With respect to the natural metric, 
1 G Oi? is a shortest and hence minimal clement. Therefore the trivial Arakelov divisor 
{Op, 1) is reduced. In general, if D = d{I) is reduced, the element 1 G / is merely minimal 
and need not be a shortest element. However, the next proposition shows that it is not 
too far away from being so. 

Proposition 7.1. Let F be a number field of degree n and let D — d{I) — (/, A^(/)~^/") 
be a reduced Arakelov divisor. Then we have 

||l||r» < for all non-zero x E I . 

In particular, the element 1 E I is at most ^Jn times as long as the shortest element in I. 

Proof. We have that ||1||d = ^/nN{I)~^/'^. Since 1 G / is minimal, every non-zero 
X E I has the property that \cr{x)\ > 1 for some embedding a : F — )• C. Therefore 
\\x\\d > iV(/)-V^|(7(a;)| > iV(/)-V^. This proves the proposition. 
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If Z) = (/, w) is an Arakelov divisor and / G / is minimal, then 1 e f^^I is again 
minimal and the divisor d{f~^I) = {f~^I^ N{f is reduced. In particular, if / G / 

is a shortest element, then the divisor d{f~^I) is reduced. Note however that even though 
the element 1 E f~^I is minimal, it need not be a shortest element. Indeed, even if it is 
true that 1 is a shortest vector of the lattice associated to {f~^I, \f\~^u), it may not be a 
shortest vector of the lattice d{f~^I) = {f~^I, N{fu~^Y^'^), which has a different metric. 
In the section 9 we present an explicit example of this phenomenon. 

It is not so easy to say in terms of the associated ideal lattice ul precisely what it means 
that a divisor D — (/, u) is reduced. We make the following imprecise observation. When 
1 G / is not merely minimal, but happens to be a shortest element in /, then all roots of 
unity in F are also shortest elements in /. Usually, these are the only shortest elements in /. 
In that case the arithmetic-geometric mean inequality implies that the Hermite constant 
7(D), viewed as a function on Picp attains a local minimum oX D = {I, N{I)~^/^). So, 
the lattices corresponding to reduced divisors are the "skewest" Oi?-lattices around. But 
this holds only usually and locally. 

It is convenient to introduce the following notation. 

Definition. Let F be a number field. Let denote its discriminant and r2 its number 
of complex infinite primes. Then we put 




Proposition 7.2. Let F be a number field of degree n. 

(i) Let I be a fractional ideal. If d{I) = (/, N{I)~^^'^) is a reduced Arakelov divisor, tiien 

the inverse of I is an Op-ideal of norm at most dp- 

(a) Tlie set Redp of reduced Arakelov divisors is finite. 

~o 

(Hi) Tie natural map Kedp — > Picp is injective. 

Proof. Since 1 G /, the ideal is contained in Op. By Prop. 4.4 (ii) there exists a 
non-zero / G / for which |A^(/)-i/"(7(/)| < for each a. Therefore, if N{I-^) > dp, 
we have that |cr(/)| < 1 for each o", contradicting the minimality of 1 G /. This proves (i). 
Part (ii) follows at once from (i) and the fact that there are only finitely many Oi?-ideals 
of bounded norm. 

To prove (Hi), suppose that the reduced Arakelov divisors D = d{I) and D' = d{I') 

have the same image in Pic^. Then there exists / G F* so that /' = // and N{I'Y/'^ = 
N{I)^/'^f. As in the proof of Prop. 5.3, it follows that all conjugates of / are equal and 
hence that / G Q*. Since both / and /' contain 1 as a minimal vector, this implies that 
/ = ±1. Since / = N{I' > 0, we have that f — 1 and hence D — D' as required. 

Part (Hi) of Proposition 7.2 does not hold when we replace Pic^ by Pic^. See Exam- 
ple 9.3 below for an example. Incidentally, Theorem 7.7 below strengthens the statement 
considerably. 

For every divisor D — (J, u) of degree zero consider the following set of divisors of 
degree zero: 

So = {(/, v) G Div°, : logM < \ \og{dp) for all a}. 
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If A'"(/ ^) < dp, the set Ej) is a non-empty simplex. Indeed, under this condition 
contains the divisor (/, A/"(/)~^/'^) and any element of S^) has the form (/, iV(/)~^/'^) + 
[Opiw) with w running over the exponentials of the vectors y e (©o-R) satisfying 

ya<- (log(5F) + log(Ar(/))) , for every a. 
n 

Since deg{a)ya- — 0, the set E£) is a bounded simplex. 

The following proposition expresses the notion of a reduced divisor in terms of these 
simplices. 

Proposition 7.3. An Arakclov divisor of the form D = d{I) = (/, N{I)~^f'^) with 1 E I, 
is reduced if and only if there is no other divisor D' = d{I') with 1 e /' for which the 
image of the simplex E^) in Pic^r is contained in the image ofTio'- 

Proof. Suppose that D = {I ^N{I)~^/^) is reduced and that for some divisor D' = 
(/',iV with 1 e /' the image in Pic^ of E D is contained in the image of T^d'- 
Then D and D' lie on the same component of Pic^r- This implies that /' = // for some 
f e F*. Since 1 e / is minimal, so is / e The simplex T,d' ot rather its image in Pic^r 
is equal to the set 

{{I,v/\f\) : V satisfies log(^J|a(/)|) < Jlog(aF)}. 

Since E^ C E^/, we have for each a that log{va/\cr{f)\) < Mog(9i?) whenever log(fcr) < 
^ log(9i?). This implies that |cr(/)| > 1 for every o", contradicting the minimality of / G 

Conversely, suppose that D — (/, A^(/)~^/") is not reduced. This means that 1 G / 
is not minimal. Let g E I such that |cr((7)| < 1 for all a. Consider the O^-ideal /' = 
g~^I. Then E^ C E_d'. Indeed, if (/, w) G Ed then log(fcr) < ^ log(9i?) and hence 
log{v a-\cr{g)\) < ^log{dF)- Since (/, is equivalent to the divisor {I',v\g\), this means 
precisely (/, v) is contained in E^/. 

This proves the proposition. 

In the rest of this section we study the distribution of the image of the set Redi? in 

~ 

the compact groups Pic^ and Pic^^ and estimate its size. First we look at the image of the 
set Redp in Pic^. Theorem 7.4 says that Red^ is rather dense in Pic^;.. 

Theorem 7.4. Let F be a number field of degree n admitting r2 complex infinite primes. 
Then 

(i) for any Arakelov divisor D = (/, u) of degree there is a reduced divisor D' and an 
element f e F* so that 

D-D' = {f) + {OF,v) 

with 

1 

log \va\ < - log{dF). 
n 

In particular, we have that 

\\D — -D'fpic < lc)g(5i?), for each a; 

(a) the natural map 

UEd — > Pic^ 

D 

is surjective. Here D runs over the reduced Arakelov divisors. 
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Proof. By Minkowski's Theorem (Prop. 4.4 (ii)), there is a non-zero element f & I 
satisfying \U(ja{f)\ < dp^^ for every a. Then there is also a shortest and hence a minimal 
such element /. The divisor D' = d{f~^I) is then reduced. It lies on the same component 
of Pic^ as D. We have that 

D-D' = {f) + {OF,v) 

where v is the vector {va)a ^ Yla ^+ with v^- — Ucr\cr{f)\N{f~^iy/'^ and hence log \va\ = 
log \ucrcr{f)\ + ^ log{N{f~^I)) for every a. Since N{f~^I) < 1, this implies that log \vcr\ < 
log \ua-cr{f)\ which by assumption is at most ^ log(9i?) as required. 
Since X^o- log(i'o-) = 0, Lemma 7.5 below implies that 

\\D - D'fp,, = \\v\\l,, < n{n - 1) (^^ log(a^) 

This proves (i). Part (ii) is merely a reformulation of part (i). 

Lemma 7.5. Let Xi E H for i = 1, . . . ,n. Suppose that Yl7=i = ^^^^ x e R has 
the property that Xi < x for all i = 1, . . . ,n. Then we have Yl7=i — '^('^ ~ l)x^. 

We leave the proof of this lemma to the reader. The theorem says that Pic^ can be 
covered with simpliccs centered in the reduced divisors D. We use the Theorem to 
estimate the volume of the Arakelov class group Pic^ in terms of the number of reduced 
divisors. 

Corollary 7.6. Let F be a number field of degree n with ri real and r2 complex infinite 
primes. We have that 

r2 1 

vol(Pic°,) < ^0^{log{dF)Y'+''medF, 

< (log|A^|)^#Red^. 

Proof. Let D = d{I) = (/, N{I)~^/'^) be reduced divisor. Then the set Ed is given by 

= {(/,iV(/)-V") + (Of,v) : logM < - (log(aF) +log(iV (/)))}. 

By Prop. 7.2 (i) we have that N{I~'^) < dp- This implies that the set is a non- 
empty simplex of volume equal to log(9_FA^(/)))'^^^'^^ times the volume of the standard 
simplex {(j/a) G ©o- R- : Yla Vo^ — ^ t/a < 1 for each a}, which one checks to be equal 
to 2~~n'^~2 1 in — 1)!. This leads to the inequality 

voi(Pic°) < ^^—^^y-^o^^QFm)) 

Here the sum runs over the reduced divisors D — (/, N(I)~^^'^) of F. 

Since N{I) < 1, the first estimate follows follows. The second inequality follows by a 
rather crude estimate from the first one. This proves the corollary. 

Next we prove some kind of converse to Theorem 7.4. The following theorem and its 

~o 

corollary say that the image of the set Redi? is rather sparse in the group Pic^. Recall 
that F^ = {x e F* : (7{x) > for all real a}. 
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Theorem 7.7. Let F be a number Geld. ^ 

(i) Let D and D' be two reduced divisors in Div^^. If there exists an element f e for 
which 

with I log(fo-)| < log(|) for each a, then we have that D = D' in Div^. Similarly, if 

A '0 

\v\^ < log(l), we have that D = D' in Divp. 

II iip.^ o\3^' ^ 

(ii) The natural map 

D'eRed^^' + ^'^^'"'^ • ^ (^R.conn)" ^^d \ logK)| < ilog(|) for each a} 



■—0 

is injective. 

Proof. Suppose that D = d{I) and D' = d{I') are two reduced divisors with the property 
that D - D' + {f) = (Of, v) with f e F* for which a{f) > for all a. By Prop.5.3, 

the images of D and D in Pic^ lie on the same connected component of Pic^^. We put 
A = N{I/ry/''. Then a{f)/X = v^. Since |log(^;^)| < log(|), we have that 

\— 1| = \va - 1| = |exp(log(va)) - 1| < exp|log(vo-)| - 1 < exp(log(|)) - 1 = |, 

and hence 

|(t(/) — A| < |A, for every a. 

Since D and D' are reduced, the element 1 is minimal in both / and Therefore both 1 
and / are minimal in //' = /. 

If A is small, i.e., ifO < A < we have that \a{f)\ < \a{f)-X\ + \X\ < |A+A < |-i < 1 
for each a. In other words, |cr(/)| < |a"(l)| for all cr, contradicting the fact that 1 G / is 
minimal. If A is large, i.e., if A > |, we have that |(t(/)| > |A| — |cr(/)— A| > A— ^A > |-| = 1 
for each cr. In other words, |cr(l)| < |cr(/)| for all cr, contradicting the fact that / e / is a 
minimal vector. 

Therefore | < A < |. This implies that |a(/-l)| < \a{f)-X\ + \X-l\ < iA + |A-l| < 
I • I + I = 1 = |c(l)| for all cr. Since 1 G / is a minimal vector, this implies that / — 1 = 0. 
Therefore 1 = 1' and hence D = D' . This proves the first statement. 

If we know that ||f ||~ < log(|), then there is a totally positive unit e for which 

I log{(r{e)va-)\ < log(l) for each cr. Replacing / by ef if necessary, we may then assume 
that I log(t'cr)| < log(|) for each cr and we are back in the earlier situation. This proves (i). 
Part (ii) follows, because (i) implies that the sets 

{D' + {Of,v) : V e (F^,eonn)" ^ud | logK)| < |log(|) for each a} 

map injectively to Pic^ and that their images are mutually disjoint. This proves the 
theorem. 

Corollary 7.8. Let F be a number field of degree n. Then we have that #Redi? < 

■ n 

vol(Pic^) • (4n) 2 . 
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Proof. Theorem 7.7 (ii) imphes that the volume of Pic^ is at least ^Redp times the 
volume of the simplex {v e {{F-^ conn)° • I log(va)| < ilog(|) for each cr}, which is equal 
to 



r2 



2 2 n^^ 2 /4^\ri+r2 

(n-1)! • 
Since this is at least (4n)~^, the result follows. 

Corollary 7.9. There is a constant c > 0, so that for every number Geld F of degree n, 
the number of reduced divisors contained in a ball of radius 1 in Picp is at most (cn)"^/^. 

Proof. The reduced divisors whose images in Pic^ are contained in a ball of radius 1, 

are contained in a subset S of Pic^^ of volume 2^^ (27r\/2)^2/wi? times the volume of a unit 

ball in Pic^. By Theorem 7.7, the balls of radius | log(|) centered in reduced divisors, are 

~o 

mutually disjoint in Pic^^. Comparing the volume of the union of the disjoint balls with 
the volume of S leads to the estimate. 

Corollary 7.10. Let F be a number field of degree n. Then we have that 

(log|AH)-» < -^^^ < (snnV2)\ 
vol(Pic^) V / 



' — / — 
Proof. Since the volume of Pic^ is 2'^^(2tt\'2Y^ /wp times the volume of Pic^, the in- 
equalities follow from Corollaries 7.6 and 7.8 respectively. This proves the corollary 

We recall the following estimates for the volume of Pic^^. They say that in a sense 
the volume of Pic^ is approximately equal to A_p|. 

Proposition 7.11. Let n> 1. Then for every number field F of degree n we have that 

(0 

vol(PicO,)<^AH(log|A^|)"-^ 
(ii) (GRH) there exists a constant c > only depending on the degree n so that 

vol(Pic^) > cv^A^/logloglA^I. 



Proof. Part (i) follows from Corollary 7.7, the fact that for every reduced divisor d{I) 
the ideal is integral and has norm at most dp — {^Y^ V\^f\ estimate for 

the number of Oi?-ideals of bounded norm provided by Lenstra in [18, Thm.6.5]. Under 
assumption of the generalized Riemann Hypothesis (GRH) for the zeta function of the 
normal closure of F, Buchmann and Williams [6, (3.2)] obtained the estimate in (ii). This 
proves the proposition. 
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8. Quadratic fields. 

Since the class group of Q is trivial and since we have Z* = {±1}, the group Picg is trivial 
and the degree map induces an isomorphism Picq = R. The narrow class group of Q is 

also trivial and it follows from Proposition 5.1 that Picg = and that Picg is isomorphic 
to R*. 

This is the whole story as far as Q is concerned. In this section we briefly work out the 
theory of the previous sections for quadratic number fields. For these fields the language 
of binary quadratic forms is often used [17, 26]. 

Example 8.1. For complex quadratic fields F, the torus T° of section 2 is trivial so that 

~° 
the group Picp is canonically isomorphic to the class group Clp of F. The group Pic^ 

is an extension of Clp by a circle group of length 2n\/2/wF- Here wp = 2 except when 
F = Q(i) or Q(ii^^), in which case tUi? = 4 or 6 respectively. 

We describe the reduced Arakelov divisors of F. Let D = (/, Ar(/)~^/^) be reduced. 
The fact that 1 is a minimal element of / simply means that it is a shortest vector in 
the corresponding lattice in Fr = C. We write / = Z + /Z for some / in the upper 
half plane {z G C : lm{z) > 0}. Since Op ■ I C I, we have that / = ^~^^{^ for certain 
a, 6 e Z, a > and that — Aac — Ap for some c e Z. The O^-ideal is generated by 
a and ^"'"'^^ and has norm a. For complex quadratic fields, the simplices E r, introduced 
in section 6 are simply points. 

Since / is unique up to addition of an integer, the SL2(Z)-cquivalence class of the 
binary quadratic form N{X + fY)/N{I) = aX'^ + bXY + cY^ is well defined. The form 
has discriminant Ap. If we choose / to lie in the usual fundamental domain for the 
action of SL2(Z) on the upper half plane, the corresponding quadratic form is reduced in 
the sense of Gauss. There is a slight ambiguity here. If |/| = 1, the reduced Arakelov 
divisors d{Z + fZ) and d{Z + fZ) give rise to the quadratic forms aX"^ + bXY + aY"^ and 
aX^ — bXY + aY^ respectively. If / is not a root of unity, the Arakelov divisors are distinct, 
but the two quadratic forms are SL2(Z)-equivalent and only one of them is reduced. Apart 
from this ambiguity, the map that associates to a reduced Arakelov divisor its associated 
reduced quadratic form, is a bijection. 

Example 8.2. Any real quadratic field F can be written as Q{^/Ap) where Ap denotes 
the discriminant of F. The group Pic^ is an extension of the class group by a circle group 

and the group Pic^ is an extension of the narrow class group by a circle group. We describe 
the reduced Arakelov divisors of F. Let a and a' denote the two infinite primes of F. To be 
definite, we let a denote the embedding that maps \/Ap to the positive square root of Ap 
in R. Let D = d{I) = (J, A^(/)~^/^) be reduced. The fact that 1 G / is minimal implies 
that we can write I = Z + fZ for a unique / satisfying cr(/) > 1 and —1 < cr'(/) < 0. 
The fact that we have Op ■ I d I implies that / = ^~^2^ where Ap — b'^ — 4ac for some 
c e Z. The conditions on cr(/) and cr'(/) say that a > and \y/A^ — 2a\ < b < y/Ap. The 
O^-ideal is generated by a and ^i^^. Its norm is a. The simplex E£) of section 6 is 
an interval of length log( ^^^^ ) centered in D. 

The map that associates the quadratic form aX^ + bXY + cY'^ to the reduced divisor 
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D = (/, A^(/)~^/^), is a bijection between the set of reduced Arakelov divisors of F and 
the set of reduced binary quadratic forms of discriminant d^p with o > 0. 

The element 1 G / is a shortest vector precisely when both ||/|| and ||/ — 1|| are at 
least ||1|| = \/2. This condition is not always satisfied. Drawing a picture, one sees that 
it is when a{f) — cr'{f) > 2, or equivalently when a < ^y/Ap-, but this is not a necessary 
condition. 

When D = d{I) and I = Z + fZ as above, then the vector / is a minimal element of /. 
Therefore D' — d{f~^I) is a reduced Arakelov divisor. We have that D = D'+(f) + {OF, v), 
where ^; e F;^ ^ R* x R* is the vector {\a'{f)/a(f)\^/^, -\a{f)/a'{f)\^/^). The distance 

between the images of D and D' in Pic^ is equal to Iflpic- Since / = we have 

Itjlpic = ^^loglfr"^^!- ^l^is way we recover Lenstra's distance formula [17, (11.1)]. 
The divisor D' is the 'successor' of D in its component, in the sense that there are no 
reduced divisors on the circle between D and D'. In order to obtain D's 'predecessor', 
take g the shortest minimum such that |cr(^)| < Ic'lfif)!- Then the Arakelov divisor d{g~^I) 
is the predecessor of D. 

Lenstra's group T or rather its topological completion JF, is closely related to the 
oriented Arakelov class group of the real quadratic field F and several of the results in [17] 

are special cases of the results of this paper. The group JF is not quite equal to Pic^ but it 

admits a degree 2 cover onto it. More generally, for a number field F we let Pic J denote 

- — 

the group Div^ modulo its subgroup ±F^. When F is totally complex, i.e., when ri = 0, 
— 

this is simply Pic^T^. When ri > however, there is an exact sequence 

— > {±1}'^V{±1} — > Pic+ — > pTc^ — ^0. 

Let = {tt e Fr : \N{u)\ = 1}. The topological structure of PicJ can be seen from 

the exact sequence 

0^ (F^)7±o^,+ Pi4 Ch,+ -^0, 

realizing Pic J as an extension of the narrow class group CIf,+ by a 2^^" ^-component Lie 
group. When F is real quadratic, the group PicJ is equal to Lenstra's group J^. 
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9. Reduced Arakelov divisors; examples and counterexamples. 

Let F be a number field of degree n and discriminant A/. . Theorems 7.4 and 7.7 say 
tliat tlie image of the set Redi? of reduced Arakelov divisors is, in a precise sense, rather 

~° 

regularly distributed in the groups Picp and Pic^. In this section we discuss these results 
and we consider variations in the definition of the set of reduced divisors. 

Theorem 7.4 says that the image of Rcd^r is rather 'dense' in Pic^. I do not know how 

~ Q 

to prove similar result for the larger group Pic^ rather than Pic^^. I cannot even exclude 

~o 

the possibility that some components of Pic^ contain no reduced Arakelov divisors at all. 
The problem is related to the following question. 

Question 9.1. Let L C R"^ be a lattice of covolume 1. Suppose that all non-zero vectors 
of L have all their coordinates different from zero and have length at least e. Does there 
exist a minimal vector (xi) G L with Xi > for all z? Here a vector (xi) is called minimal 
if the only vector (yi) G R"" with \yi\ < \xi\ for all i is the zero- vector. Does there exist 
such a vector of length 0{e~^) for some N that only depends on n? Can one compute it 
efficiently? 

~o 

In the other direction. Theorem 7.5 implies that the image of Redi? in Pic^ is rather 

~o „ 

'sparse'. When we replace Picp by Picp, the theorem is no longer true. First of all the 
map Red_F — > Picp is in general not injective. In addition, it may happen that distinct 
reduced divisors have images in Pic^^^ that are much closer to one another than the bound 
log(|) of Theorem 7.5. However, by Corollary 7.9, the number of reduced divisors in a 
ball in Pic^ of radius 1 is bounded by a constant only depending on the degree of F. 

Lemma 9.2. Let F be a number Geld of degree n, let D = (/, u) be an Arakelov divisor 

and suppose f E I. Then 
(i) d{f~^I) = d{I) in Div^ if and only if f is a unit of Op- 

(a) The classes of d{f~^I) and d{I) in Pic% are equal if and only if f is the product of a 

unit and an element g E F* all of whose absolute values |cr((7)| are equal. 
(Hi) \\d{I) - rf(/-i/)||pi, < 2V^max,|log|a(/)||. 

Proof. Part (i) follows from the fact that / = f~^I if and only if we have / G Op. Since 
we have 

d{f-'i)-d{i) = {fOF,mf)\'/n, 

the class of this divisor is trivial in Pic^ if and only if there is ^ G F* for which f = eg for 
some unit £ G and \a{g)\-^ = |A^(/)r^/" for all a. Since \N{g)\ = \N{f)\, the second 
relation is equivalent to the fact that the |cr((7)| are all equal. This proves (ii). 

To prove (Hi) we note that \\d{I) - d{f-^I)\\p-^ < y^maxo- |log|(T(/)/A^(/)i/"|| which 
is at most y/n times maX(^|log|cr(/)|| -|- ^ deg(a")|log|a"(/)|. This easily implies the 
estimate. 

This implies that / is a root of unity. This completes the proof of the lemma. 
Prop. 7.2 (Hi) says that the natural map from the set of reduced divisors Redp to 

the oriented Arakelov class group Pic^ is injective. The following example shows that, in 
general, the map Redi? — > Pic^ is not. 
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Example 9.3. Let a > b > 1 and put A = 6^ — 4a^. Suppose that A is squarefree and 
let F denote the complex quadratic number field Q(\/A). Let / denote the fractional 
O^-ideal Z + /Z where / = Then 1 e / is minimal. Let a : F — > C denote 

the unique infinite prime. Since cr(/) has absolute value 1, the element / is also minimal. 
Since / is not a unit of Op, Lemma 9.2 implies that the reduced divisors d{I) and d{f~^I) 
are distinct, but that their classes in Pic^ are equal. 

~ 

Theorem 7.7 says that the distance between the images of the reduced divisors in Pic^ 
is bounded from below by an absolute constant. The following example shows that this is 
false for the Arakelov class group Pic^. 

Example 9.4. Let n be a large even integer such that A = + 1 is squarefree and 
consider the field F = Q(\/A). Let / — e F. Then 1 is a minimal element 

in / = Z + /Z. The conjugates cr(/) are close to 1 and —1 respectively. Indeed, we 
have |log|cr(/)|| «i A~^/^ for each infinite prime a. It follows from Lemma 9.2 (in) that 
the classes of the reduced divisors d{I) and d{f~^I) are at distance at most 2\/2 A~^/^ 
in Pic^. 

The definition of the set Redp is rather delicate as we'll see now by considering slight 
variations of it. We let Red^ denote the set of divisors d{I) for which 1 e / is a shortest 
rather than a minimal vector and write Red^ for the set of divisors d{I) for which we have 
N(I~^) < dp = [^Y^ \/\Af\ and for which 1 e / is merely primitive, i.e., not divisible by 
an integer d > 2. Since shortest implies minimal and minimal implies primitive, we have 
the following inclusions of finite sets 

Red^ C Redi? C Red'^. 

Theorem 7.4 says that the set Red^? is rather 'dense' in the Arakelov divisor class group. 
It is not clear whether the set Red'^ has the same property. The proof of Theorem 7.4 
showing that every D — {I,u) of degree is close to a reduced divisor D' e RedF does 
not work for Red'^. Indeed, tracing the steps of the proof of Theorem 7.4, we see that if 
/ G / is a shortest vector, it is also minimal and hence the element 1 G f~^I is minimal. 
It follows that the divisor d{f~^I) is in Redi;'. However, 1 need not be a shortest vector 
in f~^I so that d{f~^I) may not be contained in Red^. 

The following example shows that this phenomenon actually occurs. It shows that 
the set Red'^ is, at least in this sense, too small. 

Example 9.5. We present examples of reduced Arakelov divisors D = d{I) with the 
property that the element 1 G / is not a shortest vector of the lattice / associated to (/, u) 
for any u G F^. This implies that D is not equal to d{f~^J) for any divisor D' = {J,v) 
and a shortest element f E J. Indeed, if that were the case, 1 would be shortest vector in 
the lattice associated to the Arakelov divisor (/, f~^v). 

Let F be a real quadratic number field of discriminant A. Then F = Q{^/A). Suppose 
that d{I) is a reduced Arakelov divisor. We write / = Z + /Z where / > and — 1 < / < 0. 
Here we identify F with its image in R through one of its embeddings and we write f ^ f 
for the other embedding. 
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Claim, li N{f — ^) > — |, then 1 is not a shortest element of / for any degree zero 
Arakelov divisor {I,u). 

Proof. Suppose that D = (/, u) has degree 0. Then we have u — {v / ^JN{I), j yJW{T)) 
for some v G R>o- Suppose that 1 G / is a shortest vector in the lattice associated to D. 
This implies in particular that ||l||j) < l/lj^ and < \\f — This means that 

v~'^ + < v~'^p + v'^f and that f ~^ + < f ~^(/ — 1)^ + f ^(/ — 1)^. In other words 

2 2 

we have that < {p — I)/ {I — f ) and > (2/ — P)/{f — 2/) respectively. Therefore, 
if the upper bound for is smaller than the lower bound, there cannot exist such v. This 
happens precisely when (/ — /)(2// — / — / + 2) > 0. Since / — / is positive, this means 
that 2/7 - /- 7+ 2>0 which is equivalent to A^(/ - ^) > -f - This proves the claim. 

When / = '^^2a^ section 8, a sufficient condition for the inequality of the claim 
to hold is that a > -^\/A. An explicit example is provided by the field Q{^/21) and the 

reduced divisor d{I) where / = Z + /Z with / = . 

// ~o 
In the other direction, it may happen that the image of Red^ is very dense in Picp^, 

so that an analogue of Theorem 7.7 does not hold for this set. We present two examples, 

~o 

due to H.W. Lenstra showing that for some number fields certain small open balls in Pic^ 
contain the images of very many D G Red'^. Both examples exploit the existence of certain 
'very small' elements in F. In the first example these are contained in a proper subfield, 
but this is not the case in the second example. 

Example 9.6. Let F be a number field of degree n containing Q(i). Let m, m' & Z 
satisfy ^lAi?!^/^"- < m, m! < |Ai?|^/^" — 1. Let / and /' denote the inverses of the Op- 
ideals generated by m — z and m' — i respectively. Then 1 is primitive in both / and /' 
and the norms of and do not exceed dp = (f |Af|^/^. It follows that d{I) and 

d{I') are in Red^. If the images of d{I) and d{I') in Pic^^ are equal. Prop. 6.4 implies that 
/ = ml' for some m G Q*. Since 1 is primitive in both / and it follows that m = ±1. 

This implies that 1 = 1' and hence that A^(/) = + 1 is equal to N{I') = m'^ + 1, so 

~ 

that m = m' . Therefore d{I) and d{I') are distinct in Pic^, whenever m and m' are. 

Assume in addition that \m — m'\ < |Ai?|^/'^" and that |Ai?| > 4^". Then the distance 

between m and m' is much smaller than m and m' themselves. The distance between the 

~ 

Arakelov divisors d{I) and d{I') in Pic^ is at most v^|log((m — i)/{m' — This does 
not exceed ^/n\m — m'\/{\m — i\ — \m — m! 

4V^||Aj^|-l/6n. 

In this way we obtain lAj;'!^/^"^ elements of Red^ whose images in Pic^ are distinct, 
but are as close as 4^/^! | Ai?|~^/^" to one another. By varying F over degree n/2 extensions 
of Q(i), we can make |Ai?| as large as we like. One may replace Q(i) by any number field 
and proceed similarly. 

Example 9.7. Let n > 4 and a G Z be such that the polynomial X" — a is irreducible 
over Q. Let a denote a zero and put F = Q(q;). Suppose that the ring of integers of F 
is equal to Z[a\. There are infinitely many such integers a. Then |A_p| = n'^\a\'^~^ and 
\(T{a)\ = lal^/" for every infinite prime a. Let m, m' G Z satisfy ||a|^/^~-^/^"' + \a\-^/'^ < 
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m,m' < laj-*^/^"^/^"^ and |m — m'\ < \a\^/^. Consider two Arakelov divisors d{I) and d{J) 
given by = (m — a)OF and = {m' — a)OF- The norms of and are at 
most dp = {^Y^ \Af\^^'^- Since both / and J contain 1 as a primitive element, we have 
d{I), d{ J) G Redj7. The argument used in Example 9.6 shows that the images of d{I) and 

d{J) in Pic^ are distinct when m ^ m! . The difference between d{I) and (i(J) is equal to 
{IJ~^,N{IJ~^Y/^) which is equivalent to {Of,v) where 



V = 



f \ / / \ 1/"- 
m — a{a) ( m — 



m' — a {a) 



N 



m — a 



It follows that —d( J) ||~ is at most 2^71 maxcr log(^7Z^^) ■ Since (m — (T(Q;))/(m' — 
cr{a)) = 1 + (m — m')/{m' — (T{a)) and since \m! — cr(a)| > m' — \(T{a)\ > ^ |a|"'^/^~^/^"', the 
absolute value of the logarithm of (m — 17(0;))/ {m' — a{a)) is at most 4|m — m'|/|a|^/^~"'^/^"' 
for each a. It follows that \\d{I) — d(J)\\~ is at most 4^/n\a\~^/^'^^/'^'^, which becomes 

Pic 

arbitrarily small as |a| grows. 

10. Computations with reduced Arakelov divisors. 

In this section we discuss the set of reduced Arakelov divisors from a computational point 
of view. Our presentation is rather informal. In particular, we do not say much about the 
accuracy of the approximations required to perform the computations with the real and 
complex numbers involved. See [30] for a more rigorous approach. Since Arakelov divisors 
can be represented as lattices in the Euclidean space Fr,, lattice reduction algorithms 
play an important role. When the degree n of the number field is large, the celebrated 
LLL-reduction algorithm [16, 20] is an important tool. 

We suppose that the number field F is given as Q(a) where a is the zero of some 
irreducible monic polynomial </7(X) G Z[X]. We assume that we have already computed 
an LLL-reduced basis {cji, . . . , Un} for the ring of integers Op embedded in Fr. In other 
words, we have an explicit lattice 

OF^iOiZ + ... + iOnZcFn, 

with, say, an LLL-reduced basis {ui, . . . ,a;„}. Such a basis can be computed as explained 
in [18, sect. 4] or [10, sect. 6.1] combined with a basis reduction algorithm. We have also 
computed a multiplication table i.e., coefficients Xijk G Z for which cOiCOj = Xlfc -^iifc^^A;- 
The discriminant of F is the integer given by Ai? = det(Tr(a;ia;j)). By [18, section 
2.10] we have that Xijk — \Af\'^^'^^. We view the degree n of F as fixed and estimate the 
running times of the algorithms in terms of |Ai?|. 

An Arakelov divisor or oriented Arakelov divisor D — {I, u) is determined by its 
associated ideal / and the vector u G F^ = Yl^ F* . It can be represented by an n x n 
matrix A^j for which the vectors XijUj are an LLL-reduced basis for the lattice / C Fr, 
together with a sufficiently accurate approximation of the vector u — (W(j)ct- We have that 
Xij = 0{N{I)). See [30]. In practice, one might want to take logarithms and work with the 
vectors (log(tto-))o-- There are efficient algorithms to multiply ideals, to compute inverses 
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and to test for equality. See [10, sects. 4. 6-8]. Using these one can compute efficiently in the 
group Divp. The algorithms have been implemented in the LiDIA, MAGMA and PARI 
software packages [21, 22, 24]. 

Rather than the Arakelov divisor group, we are interested in computing in the Arakelov 
class group Pic^. We do calculations in this group by means of the set Redi? of reduced 
divisors in Div^r- By Theorems 7.4 and 7.7, the image of the finite set Redi? is in a 

certain sense regularly distributed in the compact groups Pic^ and Pic^. Reduced divisors 

have one further property that is important for our application: a reduced divisor D 
is of the form D — d{I) = (/, A^(/)~^/") where is and integral ideal of norm at 
most dp — {^Y^ lAiT'l^/^. Therefore D can be represented using only (log| Ai?!)'^^"^^ bits. 

Before describing the algorithms, we formulate a lemma concerning the Lenstra- 
Lenstra-Lovasz (LLL) lattice reduction algorithm [16]. 

Lemma 10.1. Let bi, . . . , b„ be an LLL-reduced basis of a real vector space V. Then for 
every vector x = ^"^j^ mjbi ofV we have that 

\mi\m\\ < (-^J ||x||, forl<i<n. 

Here b^, . . . , b* denotes the Gram-Schmidt orthogonahzation of the basis bi, . . . , b^. 
Proof. See [20]. 

Corollary 10.2. Let bi, . . . , b„ be an LLL-reduced basis of a real vector space V. Then 
we have for any vector x = l^^Li ™ibi in V that 

7i~i /3\ * ||x|| 
\mi\ < 2 2 fori = l,...,n. 

Proof. The LLL-conditions [16] imply ||bi|| < 2^||b*|| for every i = l,2...,n. Since 
bi = bj, the result follows from Lemma 10.1. 

We have the following basic algorithms at our disposal. For number fields of fixed 
degree n, each runs in time polynomial in log|Ai?|. 

Algorithm 10.3. (Reduction algorithm) Given an Arakelov divisor D = {I,u) e Div^, 

- check whether it is reduced or not; 

- compute a reduced divisor D' that is close to D in Picp. 

Description. We compute an LLL-reduced basis bi,...,bn of the lattice ul C Fr,. 
Any shortest vector x = ''^i^i lattice satisfies ||x||/||bi|| < 1. Therefore Corol- 

lary 10.2 implies that the coordinates G Z are bounded independent of the discriminant 
of F. To compute a shortest vector in the lattice in time polynomial in log \ ^f\, we may 
therefore just try all possible m^. 

In order to compute a reduced divisor D' that is close to D in Pic^, we compute 
a shortest vector / in the lattice / associated to D. The divisor D' = d{f~^I) is then 
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reduced. Moreover, by Theorem 7.4 or rather its proof, the divisor D' has the property 
that \D — -D'lpic < log(9F), so that D' is close to D. 

In a similar way one can check that a given divisor D = (/, u) is reduced. First of all 
we must have that u — N[I)~^/'^. Then we check that 1 is contained in /. To see whether 
or not 1 is a minimal element of 7, we need to make sure that the box 

B = {{y^) e Fr : \y„\ < 1 for aU a.}. 

contains no non-zero points of the lattice / C Fr,. The box B contains all vectors of length 
at most 1. On the other hand, every vector in B has length at most ^/n. 

If the first vector bi of the LLL-reduced basis has length less than 1 / ^/n, it is contained 
in B and the element 1 G / is not minimal. In this case we are done. Suppose therefore 
that we have ||bi || > \j \fn. It suffices now to compute all vectors x in the lattice that have 
length less than ^fn and see whether they are in the box B or not. By Corollary 10.2, the 
vectors x = "^i^i of length at most ^fn have the property that 




So, the number of vectors to be checked is bounded independently of the discriminant of F. 
This completes the description of the algorithm. Both algorithms run in time polynomial 
in log \Af\, log and the logarithmic height of N{I). 

Algorithm 10.4. (Composition algorithm,.) Given two reduced Arakelov divisors D = 
d{I) and D' — d{J), compute a reduced divisor that is close to the sum D + D' in Pic%. 

Description. One first adds D and D' as divisors. Since N{I~^), N{J~^) < dp, the 
result (/J, N{IJ)~^/^) can be computed in time polynomial in loglAi?]- Then one reduces 
the result by means of Algoithm 10.3. Since we have N(IJ)~^ < dp, the running time of 
this second step is also polynomial in log|Aj7|. 

Algorithm 10.5. (Inversion algorithm.) Given a reduced Arakelov divisor D — d{I), 
compute a reduced divisor that is close to —D in Pic^. 

Description. One just computes the inverse ideal and reduces the divisor d{I~^) by 
means of Algorithm 10.3. Since N(I~^) < dp, the running time of this algorithm is also 
polynomial in log \Af\. 

Before describing the next algorithm, it is convenient to prove a lemma. 

Lemma 10.6. Let D — {I,u) be an Arakelov divisor of degree and let e > 0. Then 
every reduced divisor at distance at most e from D is of the form d{IiJ,~^) where /j, is a 
minimal element of I satisfying 

II// Id < ^/ne'^'^\\y\\]:,, for all non-zero y & I. 

In particular, the inequality holds for a non-zero y E I that is shortest with respect to the 
metric of P. 
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Proof. Let D' be a reduced divisor for which we have \D — -D'fpic < e- Then we have 
D' = d{I^~^) for some minimal element ^ & I. By Proposition 6.2 there is a unit e so 
that for D" = D- (//) + (Op, \e\) we have 

g-||D'-D"||p, < Md_ < el|i^'-i^"||Pic^ for every ///-I. 

\\x\\d" 

We multiply /x by £. Then /x remains a minimal element of / and the divisor D' does not 
change. But now D" is equal to D — (fi). Since we have \\D — -D'||pic = \\D' — L>"||pic, the 
inequality above and Proposition 7.1 imply that 

WMd = ||l||r>-(/i) < e'||l||r'' < e^^/nlxWo' < e^' = e^''^/n\\x|J,\\D, 

for any non-zero x e It follows that we have \\fi\\D < -\/^6^^||j/||_d for all non-zero y & I. 

This proves the proposition. 

I owe the following algorithm to Hendrik Lenstra. See [2, 4, 30] for a different approach. 

Algorithm 10.7. (Scan algorithm.) Let D = (/, u) be an Arakelov divisor of degree 
and let R> 0. Compute all reduced Arakelov divisors in a ball in the Arakelov class group 
of radius R and center D in time polynomial in log | Aj? | and linear in the volume of 
the ball. 

Description. Choose e, e' e R such that < e' < e < i?. Inside the open ball of divisors 
in Pic^T' having distance at most R + £ from D, we compute a web of regularly distributed 
points. The points P in the web are at most e and at least e' apart, say. By Theorem 7.4 
every P is the class of a divisor of the form D' + {Of,v) for some reduced divisor D' — d{J) 
and a totally positive v e satisfying ||f fpic < log{dF)- Moreover, LLL-reduced bases 
for the lattice associated to each P can be computed in time polynomial in log|Ai?|. 

By Lemma 10.6, the reduced divisors we are looking for arc among the divisors of the 
form d{Jn~^) where D' = d{J) is reduced, P = D' + {Of, v) is in the web and /U G J is a 
minimal element for which ||//||p is at most e^'^^/n times the length of a shortest non-zero 
element x E J. So, it suffices to compute the elements fj, for all P in the web. For a given 
P, Corollary 10.2 says that the number of vectors e J of length at most ^^^Jn times 
the length of the shortest non-zero vector, is bounded independently of P and even of the 
discriminant of F . They can be computed in time polynomial in log \^f\- Minimality of 
the elements \i can be tested by means of Algorithm 10.3. Finally, since the divisors P 
are at least e' apart, the number of points in the web is proportional to the volume of the 
ball. This completes the description of the algorithm. 

Algorithm 10.8. (Jump algorithm.) Given the coefficients of a divisor D = npp + 

J2a ^crO' of degree 0, compute a reduced Arakelov divisor whose image in Pic% has distance 
less than log(5i?) from D. 

Description. We assume that at most 0(log |Ai?|) coefficients of D are non-zero and that 
the coefficients themselves are of size | Ai?!'^^-'^). Directly applying the reduction algorithm 
to D is not a very good idea, since the LLL-algorithm and therefore the reduction algorithm 
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run in time polynomial in log \\u\\ which is exponential in the terms of the log(a;cr). Therefore 
we proceed differently. 

It is easy to compute a reduced divisor that is close to d{I). Here / is the ideal Yip P"'' • 
Indeed, for each prime ideal p with rip ^ 0, we compute a reduced divisor D' close to 
d{p) = (p,iV(p)-i/") and then by successive squarings, multiplications and reductions 
we compute a reduced divisor close to d{I). Here we use the binary expansion of the 
coefficient Up . The coefficients at the primes p of the divisor D — d{I) are all equal to zero. 
Therefore it suffices to explain how to compute a reduced divisor that is close to a given 
divisor D of the form D — {Of,v) for some v. 

We first compute a list of ri + r2 — 1 reduced divisors Ei in the connected component 
of identity of Pic^ that are equivalent to divisors {Op^Vi) that have the property that 
the vectors vi form a reasonably orthogonal basis of short vectors of the, multiplicatively 
written, metric vector space (n(j-f^+)^- This can be accomplished as follows. Pick wi G 
(W^ R;!^)° of length logjApl at random and reduce the divisor {Of-,wi) to Ei = d^fi^Op) 
for some /i G Op- Then Ei is equivalent to {Of-,vi) where vi — |/i|/|iV(/i)|^/"'Wi. 
When Ei,...,Ei are constructed, then pick Wi+i of length log|Ai?| in the orthogonal 
complement of the span of {vi, . . . ,Vi} inside (nCT-^)° reduce {OpjWi+i) to E'i+i, 
which is equivalent to (Op^Vi+i) where Vi-^-i = |/i_|_i|/|A'"(/i_|_i)|^/"'Wi+i for some fi^i G 
Op- This completes the description of the calculation of the 'good basis' {Ei}. 

To express D — {Op, v) as a sum of the divisors Ei, we solve a linear system and 
write v = Hi ^i^^ let rrii denote the integers nearest to Aj for 1 < z < ri +r2 — 1. Then 
the coefficients rrii are at most 0(\Af\'^^^^)- Using the binary expansion of the coefficients 
rrii we compute the sum rriiEi by means of successive compositions and reductions. 
The result is a reduced divisor that is quite close to {Of,v). One can get as close as 
log(9_F) to D by additional compositions with the divisors Ei or by adjusting the infinite 
components and reducing. We leave this to the reader. The amount of calculations to do 
all this is bounded by log| Aj?|*^("'). 

This completes the description of the algorithm. 

We leave the reader the task of modifying these algorithms so that they work for 
- — ~ 

the group Div^ of oriented divisors and for the oriented Arakelov class group Pic^^. The 

only difference is that the unit u of an extended Arakelov divisor Z) = (/, fx) is a complex 

rather than a positive real number. The image of the set of reduced Arakelov divisors in 

— 

this group is probably also reasonably dense in Pic^ and that's all we need for the Jump 
Algorithm to work. See Question 9.1. 

Application 10.9. As an application we present an algorithm to compute the function 
h^{D) that was introduced in [31]. For an Arakelov divisor D = {I,u), the number h^{D) 
should be viewed as the arithmetic analogue of the dimension of the space of global sections 
of a divisor D on an algebraic curve. The number h^{D) depends only on the class of D 
in Pic^ and is defined as 

h'{D) = log{J2eM-7^\\f\\l))- 
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See section 4 for the close relation between the function h^{D) and the Hermite con- 
stant 7(-D) of the ideal lattice associated to D. Since the short vectors f & I contribute 
the most to this exponentially quickly converging sum, the function h^{D) can be evalu- 
ated most efficiently when we know a good, i.e., a reasonably orthogonal basis for /. As 
we explained above, a direct application of a lattice reduction algorithm to D may be very 
time consuming. Therefore we apply the Jump algorithm. We jump to a reduced divisor 
D' = d{J) close to D in Pic^. Then D is equivalent to D' + (Op^v) for some short v e 
and 

h^D) = h'{D' + (Or^v)) = log(5^exp(-7r||/||^,+(0.,.))): 

= log(5^exp (-7rAr(J)-2/"5^degH|a(/)| 
feJ \ <T 

Since D' is reduced and the vector v = {vcr)cr is short, an LLL reduced basis for the lattice 
associated to D' + {Of,v) can be computed efficiently . Such a basis can be computed 
efficiently since is an integral ideal of norm at most |Ai7'|^/^. This completes the 
description of the algorithm to compute h^{D). 

11. A deterministic algorithm. 

In this section we describe a deterministic algorithm to compute the Arakelov class group 
of a number field F of degree n and discriminant Ai?. It runs in time proportional to 
■\/| A_p| times a power of log \ ^f\- 

Lemma 11.1. Let B > 0. Then any ideal J C Op with N{J) < B is of the form 

J — xl~^ , where 

- the Arakelov divisor D — (/, A^(/)~^/") is reduced; 

- the element u = N{x)^/'^/\x\ of F^ satisfies ||tt||pic < log{dF); 

- the element x is contained in I and satisfies \\x\\d^(^Of,u) < \/nB^I'^ . 

Proof. Suppose that J G Op satisfies N{ J) < B. By Minkowski's Theorem there exists 
y G J~^, a shortest vector in C Fr, satisfying \(j{y)\ < N{J)~^/^d]/^ for every a. 
We pick such an element y, put x = 1/y and / = xJ~^. Then the Arakelov divisor 
D = (/, A/"(/)~^/"') is reduced. Moreover, since xl~^ = J C Op, we have x E I. 

Writing u = N{xy/'^ /\x\, all coordinates of the vector N{I)~^f'^ux have absolute value 
iV(/)-i/"A^(x)i/" = N{JY/'' so that \\x\\d+^Of,u) = ■s/riN{jy/'' < V^S^/". Finally, we 
estimate Iwlpic- Since N{I) < 1, we have 

\u,\ = = \a{y)\\N{x)\'/^ < N{J)-'/^d]/''\N{x)\'/^ = N{I)'/^dl/'' < 9^". 

\a{x)\ 

1 /2 

Lemma 7.5 implies than that ||w||pic < (l — ^) log{dp) < \og{dp) as required. 

It is not difficult to see that the converse of Lemma 11.1 also holds: any ideal J C Op 
for which the three conditions are satisfied, automatically has norm at most B. 
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Algorithm 11.2. Suppose we have computed all reduced divisors in a given connected 
component of the Arakelov class group Pic^. In the component, detect all divisors that 
are of the form (J-^ iV(J)i/'^) with J cOp and N{J) < dp- 

Description. Let e, e' e R such that < e' < e. For each reduced divisor D = 
(/,iV(/)-i/") in the given connected component, we make a web in the ball of center D = 
(/, N{I)~^/'^) and radius log(c)F), whose members P = D -\- {Op, v) = (/, N{I)~^^^v) are 
at most e and at least e' apart. For each divisor P — D -\- {Opiv) in the web, we compute 
the vectors x for which we have ||a;||p < ^Jne^'^d^p'^ . This is done as follows. First we com- 
pute an LLL- reduced basis bi, . . . , b„ for the lattice associated to the Arakelov divisor P. 
Let b*, . . . ,b* denote its Gram-Schmidt orthogonalization. By Lemma 10.1 we have for 
any vector x = Yl7=i ''^i^i lattice for which ||a;||p is at most y/ne^'^dy^ , that 

We simply try all coefficients satisfying this inequality. 

For each such element x we then compute the corresponding ideals J = I~^x. The 
ideals J that we compute in this way are contained in Of- Moreover, every ideal J G Op 
of norm at most dp and for which the Arakelov divisor (J~^, N{J)^/'^) lies on the given 
component, is obtained in this way. Indeed, if we have N(J) < dp, Lemma 11.2 with 
B = dp implies that J = xl~^ for some reduced divisor d{I) = {I ,N{I)~^^^) and some 

X & I. Moreover, we have ||ic||D+(OF,w) V^d]/^ for some u satisfying ||w||pic < ^og{dp). 
This means that the divisor D + {OpjU) is contained in the ball of center D = (/, A^(/)~^/") 
and radius log(9i;'). Therefore there is a member P — D + {Op,v) of the web at distance 
at most e from D + {Op,u). Proposition 6.2 implies then that 

II II ^ 2e / — qI/'^ 

as required. 

This shows that we encounter all ideals J that we are after. But we'll find many more 
and we'll find each ideal many times. Indeed, the vectors x = Yl7=i thai we consider 

in the computation above satisfy |mi|||b*|| < ( -^j y/ne'^'^dp for each i and hence 

It follows from the arithmetic geometric mean inequality that for the ideal J — xl~^ we 
have 

/ o \ n(n-l) 

N{J) = N{xl-^) < n"/2e2^'^ f j dp. 

In order to estimate the running time of this algorithm, we estimate the number of ideals 
J that we compute and in addition, we estimate for how many divisors P in the web and 
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how many vectors x, we obtain each ideal J. By [18, Thm.6.5], the number of ideals J is 
bounded by y^jAp^ times a power of log lA^I times a constant that depends only on the 
degree n. Next we bound the number of times we find each ideal J. 

First, suppose that for some divisor P = (/, A^(/)~^/") + {Of,v) in the web, there 



r-l 



are two elements x,x' & I ^ satisfying ||x||p, ||x'||p < ^Jne^'^dp , for which the ideals xl 

and x'I~^ are the same. Then we have \a{x)N{I)~^/'^Va\ < y/ne^^dp^ for each a. Since 
we have \N{v) \ = 1, the product over a satisfies 

JJ|(j(a;)iV(/)-i/"^;^|'^^s('^) = N{xl-^) > 1. 

Therefore we have 

-(n-l)log(V^e2^4/^) < log|(7(a;)iV(/)-V"i;,| < log{V^e'''d]/'') 
for every a. We have the same inequalities for x'. Therefore the unit e — x' fx satisfies 

a{x') 



— log{dF) — nlog{y/ne ^) < log|(T(£)| = log 



a{x) 



< log(9i?) + nlog{\^e 



2e\ 



for every a and hence we have 

II log |£| II < \/n log(9p) + n^/^ \og{^/ne'^^). 

By Dobrowolski [12], there exists an absolute constant c > 0, so that any unit e G 0*p that 
is not a root of unity satisfies || log |£| || > cn~^/^. Since the number of roots of unity in F is 
0(nlog(n)), the number of units satisfying the bounds above is bounded by a polynomial 
expression in \og{dF)- It follows that the number of distinct elements a; e I for which the 
ideals xl~^ are equal to the same ideal J C Op is also bounded by a polynomial expression 
in log(ap). 

Next, suppose that an ideal J C Op of norm at most dp is of the form xl~^ where 
D — {I , N{I)~^/'^) is a reduced divisor and x & I satisfies ||x||p < e^'^-Jnd^p'^ for some 
divisor P = D + (Op, v) in the web constructed. In particular, v satisfies ||f fpic < log(9p). 
This implies that 



a{x) 



iV(a;)i/r 



(7(a;)Ar(/)^/> 



1 



It follows that the Arakelov divisors P and (J ^, N{jy/'^) are rather close to one another 
in Pic^. Indeed, we have 

IIP - (J-\Ar(J)i/-)||p.^ ^ ||(Op, \x\N{x)-y-v-')\\p,,. 

Since we have log \a{x)N{x)~^/^v~^\ < log{^/ne^'^^p^) for every infinite prime a, it follows 
from Lemma 7.5 that we have 



|P - ( J, iV( J) V-)||p., < log(n2/V^/"ap). 
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By Corollary 7.9, the number of reduced divisors in a ball is bounded by some constant, 
depending only on the degree of the number field, times its volume. Therefore the num- 
ber of web members P for which we encounter a given ideal J C Op, is bounded by a 
polynomial expression in log(9i?). 

This completes the description and our analysis of the algorithm. 

A Deterministic Algorithm. Finally we explain the deterministic algorithm to compute 
the Arakelov class group of a number field F. This algorithm seems to have been known to 
the experts. It was explained to me by Hendrik Lenstra. We start at the neutral element 
(Op, 1) of the Arakelov class group. We use Algorithm 10.3 to determine all reduced 
Arakelov divisors in the ball of radius 21og(9ir) and center {Op, 1). Then we do the same 
with the reduced divisors D we found: determine all reduced Arakelov divisors in the 
ball of radius 2 log{dF) and center D. Proceeding in a systematic way that is somewhat 
complicated to write down, we find in this way all reduced divisors in the connected 
component of identity. Keeping track of their positions in terms of the coordinates in Yl^ 
one computes in this way the absolute values of a set of generators of the unit group 0*p. 
The running time is proportional to the volume of the connected component of identity 
and is polynomial in log \ ^f\- 

Next we use Algorithm 11.2 and make a list £ of all integral ideals J C Oj? of norm at 
most dp, for which (J-^ iV( J)i/'^) is on the connected component of identity. The amount 
of work is again proportional to the volume of the connected component of identity and 
polynomial in log|Aj?|. By Minkowski's Theorem, the prime ideals of norm at most dp 
generate the ideal class group of F. Therefore we check whether all prime ideals of norm 
at most dp are in the list. This involves computing gcd's of the polynomial that defines 
the number field F with the polynomials — X for i = 1, 2, . . . , n for prime numbers p 
that are smaller than the Minkowski bound dp. One reads off the degrees of the prime 
ideals over p and hence the number of primes of norm p^ for i — 1,2,.... The amount of 
work is linear in the length of the list and polynomial time in \ogp for each prime p. If all 
prime ideals of norm at most dp are in the list £, then we are done. The class number is 1 
and the Arakelov class group is connected. 

However, if we do encounter a prime number p, for which a prime ideal p of norm p^ < 
dp is missing, then we compute it. This involves factoring a polynomial of degree n 
modulo p. When we do this with a simple minded trial division algorithm, the amount 
of work is at most < dp times a power of log |Ai?|. By successive multiplications and 
reductions, we compute for j = 1,2, . . . reduced divisor Dj in the connected components of 
the Arakelov class groups that contain divisors of the form (p-^ , u) for some u. Each time 
we check whether Dj is already in the list £. If it is, we stop computing divisors Dj. 

Then we repeat the algorithm, but this time we work with the connected components 
of the divisors Dj rather than {Op, 1): we use Algorithm 10.3 to determine all reduced 
Arakelov divisors in the balls of radius 2\og{dp) and center Dj. Then we do the same with 
the reduced divisors we found, and so on . . .. Once we have computed all reduced divisors 
on the connected components of Dj, we use Algorithm 11.2 to compute all integral ideals 
J C Of of norm at most dp, for which {J-\N{jy/'') is on the connected components of 
the divisors Dj and we add these to the list £,. 

When we are done with this, the list £, contains all integral ideals J C Of of norm 
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at most dp^ whose classes are in the group generated by the ideal class of p. We check 
again whether all prime ideals of norm at most dp are in the list. If this turns out to be 
the case, we arc done. The ideal class group is cyclic, generated by the class of p. If, on 
the other hand, we do encounter a second prime number g, for which a prime ideal q of 
norm g* < dp is missing, then we compute it. We compute reduced divisors that are in 
the components of the powers of q . . . etc. 

For each new prime that we find is not in the list £, we factor a polynomial and the 
amount of work to do this is at most dp- However, since the ideal class group has order 
at most y^[Apj times power of log lA^^I, we need to do this at most log \ ^p\ times. As a 
result this algorithm takes time at most -^/|A^ times power of log \ ^p\. 

12. Buchmann's algorithm. 

In this section we briefly sketch Buchmann's algorithm [7, 8] for computing the Arakelov 
divisor class group and, as a corollary, the class group and regulator of a number field F. 
This algorithm combines the infrastructure idea with an algorithm for complex quadratic 
number fields presented by J. Hafner and K. McCurley [14] in 1989. When we fix the degree 
of F, the algorithm is under reasonable assumptions subexponential in the discriminant of 
the number field F. A practical approach is described in [10, section 6.5]. The algorithm 
has been implemented in the LiDIA, MAGMA and PARI software packages [21, 22, 24]. 
See also [30]. 

Let F be a number field of degree n. The structure of Buchmann's algorithm is 

very simple. Our first description involves the Arakelov class group Pic^ rather than the 

— 

oriented group Pic^^. 

Step 1. Estimate the volume of Fic%. By Prop. 6.5 the volume of the compact Lie group 
Pic^ is given by 

vol(Pic°,) = ""^^ ■ \Ap\'/^ ■ Res (pis). 
^ ^' 2'^i(27r\/2)'^2 I ^1 s=i^^^ > 

The computation of ri, r2 and wp = ij^^p is easy. The discriminant is computed as a 
byproduct of the calculation of the ring of integers Op. Approximating the residue of the 
zeta function 



in s = 1 is done by dividing C,p{s) by the zeta function of Q and by directly evaluating a 
truncated Euler product 

This involves factoring the ideals pOp for all prime numbers p < X. See [10] for efficient 
methods to do this. The Euler product converges rather slowly. Under assumption of the 
Generalized Riemann Hypothesis for the zeta function of F, using the primes p < X, the 
relative error is 0(X~-^/^log] Af^I). Here the 0-symbol only depends on the degree of the 
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number field F. See [6, 25]. Therefore, there is a constant c only depending on the degree 
of F, so that if we truncate the Euler product aX X = clog^|Aj?|, the relative error in the 
approximation of vol(Pic^) is at most 1/2. 

Step 2. Compute a factor basis. We compute a factor base B i.e., a list of prime ideals p 
of Of of norm less than Y for some F > 0. Computing a factor basis involves factoring 
the ideals pOp for various prime numbers p. It is convenient to do this alongside the 
computation of the Euler factors in Step 1. We add the infinite primes to our factor basis. 
By normalizing, we obtain in this way a factor basis of Arakelov divisors of degree 0. The 
factor basis should be so large that the natural homomorphism 

f © Z X © — > Picl 

\p€B a ) 

is surjective. By Prop. 2.2 this means that the classes of the primes in IB must generate 
the ideal class group. Under assumption of the Generalized Riemann Hypothesis for the 
L-functions L(s, x) associated to characters x of the ideal class group Clp of F, this is the 
case for Y > c/log^ \^f\ for some constant c' > that only depends on the degree of F. 
Taking B this big, we have that 

Pic° = ( ® Zx Qk] /H 

\p€B a ) 

where H is the discrete subgroup of principal divisors of units, i.e., the group Fl consists 
of divisors (/) where / e F* are elements whose prime factorizations involve only prime 
ideals p G i5. 

Step 3. Compute many elements in H. An Arakelov divisor D = (/, u) is called ,B-smooth 
if / is a product of powers of primes in B. We need to find elements f E F* for which (/) 
is B-smooth and hence (/) e H. This is achieved by repeatedly doing the following. For at 
most 0(log|Ai?|) prime ideals p & B pick random exponents mp G Z of absolute value not 
larger than | Af|. In addition, pick random x^- G R of absolute value not larger than |Af|. 
Replacing x^j by Xa-N{D)~^/'^, scale the Arakelov divisor D = rripp + Xa-cr so that 

it acquires degree zero. Then the class of -D is a random element of Pic^p. We use the 
Jump Algorithm described in section 10 and 'jump to D\ The result is a reduced divisor 
D' = (I, N{I)~^/'^) whose image in Pic^r is not too far from the image of D. This means 
that 

D={f) + D' + {OF,v) 

for some f E F* and v = (va) G (Jla which ||v||pic is small, at most log{dF) say. 

There is no need to compute /, but when one applies the Jump Algorithm one should keep 
track of the infinite components and compute v or its logarithm. 

Since the divisor D is random, it seems reasonable to think of the reduced divisor 
D' — (/, A^(/)^^/") as being 'random' as well. Next we attempt to factor the integral ideal 

into a product of prime ideals p E B. Since D' is random and since the norm of is 
at most Of = (|:)'^^|A_p|-'^/^ and hence relatively small, we have a fair chance to succeed. 
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If we do, then we have D' = X^pgg ripp + j/o-u and hence (/) e H. This factorization 
leads to a relation of the form 

{f) = D-D' - {Of, v) = ^(mp - np)p + ^{x^ - Va + Va)(J. 

p€B a- 

In this way we have computed an explicit element in H. 

Since we want to find many such relations, we need to be successful relatively often. 
In other words, the 'random' reduced divisors D' that we obtain, should be B-smooth rela- 
tively often. This is the weakest point of our analysis of the algorithm. In sec tion 9 the set 
Rcd'^ of Arakclov divisors d{I) for which 1 G / is primitive and N{I~^) < ^^/\Af\ was in- 
troduced. Under the assumption of the Generalized Riemann Hypothesis, Buchmann and 
HoUinger [9] showed that when Y ^ exp(A/log | A^l), the proportion of i3-smooth ideals J 
with d{J~^) e Red^ is at least exp(— -^log | Ai?| log log |Ai7'|). Here the Riemann Hypoth- 
esis for the zeta-function of the normal closure of F is used to guarantee the existence of 
suflBciently many prime ideals of norm at most a/| Ajr| and degree 1. It is likely, but at 
present not known whether the proportion of i5-smooth ideals / for which d{I) is contained 
in the subset RedF rather than Red'^, is also at least exp(— ^log | A^l log log |Af|). Even 
if this were the case, there is the problem that the divisor D' that comes out of the reduc- 
tion algorithm is not a 'random' reduced divisor. Indeed, Example 9.5 provides examples 
of reduced divisors that are not the reduction of any Arakelov divisor. These reduced 
divisors will never show up in our calculations, since everything we compute is a result of 
the reduction algorithm. It would be of interest to know how many such reduced divisors 
there may be. 

For the next step we need to have computed approximately as many elements in H as 
the size of the factor base B. This impl ies that we expect to have to repeat the computation 
explained above about exp(-\/log |Ai?| loglog|Ai?|) times. When the discriminant \A.f\ is 
large, this is more work than we need to do in Steps 1, 2 and 4. Step 3 is in practice the 
dominating part of the algorithm. It follows that the algorithm is subexponential and runs 
in time 0(exp( y^log | Ai?| log log |Air|)). 

Step 4. Verify that the elements computed in Step 3 actually generate H. Let H' denote 
the subgroup of H generated by the divisors (/) = X^pes ^pP + J2a V'^'^ ^^^^ computed 
in Step 3. The quotient group (©p^gZ x ®^'R)'^ /H' admits a natural map onto Pic^. 
Its volume is equal to the determinant of a square matrix of size ^B whose rows are the 
coefficients of a set of ^B independent principal divisors that generate H' . If the quotient 
of the volume by the estimate of vol(Pic^) computed in Step 1, is less than 1/2, then we 
have H' = H and the group (©p^gZ x ©o-R)° /H' is actually isomorphic to Pic^r and we 
are done. 

In practice this means that once we have computed somewhat more divisors (/) in H 
than ij^B, we "reduce" the coefficient matrix. From the "reduced" matrix we can read 
off the structure of the ideal class group as well approximations to the logarithms of the 
absolute values of a set of units e that generate the unit group 0*p. This enables us to 
compute the regulator Rf- 

This completes our description of Buchmann's algorithm. 
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It seems difficult to compute approximations to the numbers a{s) themselves from 
approximations to their absolute values |cr(£)|. If one wants to obtain such approxima- 
tions, one should apply the algorithm above to the oriented Arakelov class group. The 
computations are the same, but rather than real, one carries complex coordinates along. 
More precisely, we have that 



for the discrete subgroup H that consists of elements f E F* whose prime factorizations 
involve only prime ideals p E B. In this way one obtains approximations to a"(£j) for a 
basis Si of the unit group 0*p. In principle, once one has such approximations one may 
solve the linear system a{ei) = Xija{u!j) and compute Ay e Z so that Si = \j^3 
for l<z<ri-|-r2 — 1. However, it is well known that the size of the coefficients Ay 
may grow doubly exponentially quickly in log|Ai?| and it is therefore not reasonable to 
ask for an efficient algorithm that computes a set of generators of the unit group as linear 
combination of the basis Uk of the additive group Op- 

What can be done efficiently, is to compute a so-called compact representation of a set 
of generators of the unit group 0*p. Briefly, this works as follows. Using the notation used 
in the description of the Jump Algorithm of section 10, one finds for each fundamental 
unit Sj integers so that Hi ^1"'^ close to Sj. The Arakelov divisors {OpiVi) are 
equivalent to reduced divisors d{f~^). While jumping towards the fundamental unit, one 
keeps track of the principal ideals that are encountered on the way. For instance, if in 
the process one computes the sum of the divisors {OpjVi) and {Op^Vj) and reduces the 
result by means of a shortest vector /, then the result is equivalent to the reduced divisor 
d{{f fifj)~^). The size of the elements /j, fj and / . . . etc. is bounded by (log| Ai?!)*^^-*^). 
With a good strategy one can jump reasonably close to the unit. The number of jumps we 
need to reach this point is also bounded by (log| Ai?!)'^^-'^). Using the approximations to the 
fundamental units and to the vectors /i, /-,,/.. . etc, we can approximate a small element 
g E F* , so that the difference between the divisor we jumped to and the fundamental unit 
is equivalent to a divisor of the form (Oi?, (7). Since g is small, we can compute it in time 
bounded by log| Ai?!'^^^^ from its the approximations of the various o-{g). From this we 
easily obtain the fundamental unit Sj. 
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